Some time ago I completely lost all faith in any company's ability and/or willingness to actually keep my personal information private, along with my government's ability and/or willingness to regulate or disincentivize.
These fines will just be chalked up as the "cost of doing business," and the abuses will continue unabated. The only way to protect your personal information is to not allow it to be collected in the first place.
If you carry a phone, only use it for emergencies, and otherwise keep it in airplane mode. Things like GPS navigation in Organic Maps, music and podcast files in local storage, etc. work just fine without the radio. Pay cash for everything. Never give your phone number to a store and don't use rewards programs. Pop out the DCM fuse in your car. Run a firewall that blackholes spy domains, use a VPN, and block scripts and cookies. Buy entertainment on discs, again with cash. If it's not available on physical media, either go without or download it over VPN. If I can't walk into a store and buy it with cash, I will never contribute to your revenue stream. Oh, and file your taxes with paper forms sent by mail directly to the IRS. Online tax services are spyware.
Unless you decide to go it alone on medical stuff there's nothing you can do about hospitals and insurance companies fsking you over. Your employer's payroll processing company probably sells your financial info to Equifax's The Work Number, which you can allegedly freeze, I guess. For these abuses I feel government needs to get ruthless. Like, if your establishment exposes highly sensitive medical information for $thousands of people, you don't get to exist any more. Smoking crater. Prison time. Liquidated assets. Game over. Next time keep those records offline.
The world managed to run hospitals with paper forms for about 4,000 years, so you can walk records across the office on encrypted USB drives if you have to. There are 4TiB MicroSD cards now, so embed storage in employee badges that only keeps relevant records for patients they're actually caring for that day. That sort of thing just needs to be the cost of doing business with information that's that sensitive, because if it's all sitting on a network, someone somewhere sometime will inevitably screw something up.
So long as it's okay to leak private information every few years as an externality, they will continue to deploy and run systems that drive their operational costs to the absolute bottom while treating any risks to your privacy as irrelevant.