Legal penalties don't matter to people not thinking far enough ahead for them to enter the equation. They don't matter to people who think they can get away with breaking the law (much easier for electronic crime) and they don't matter to people who think they are above the law, which may be he case here.
Harsher penalties can even be counter-productive. If you're on death row for killing one person then you better make sure you kill any potential witnesses, the penalty is the same either way.
> This is exactly why victim blaming is pointless and stupid.
Fine, I'm being pointless and stupid. But if you don't care who you're giving your data too then don't expect me to care next time it ends up with someone you didn't want.