This shouldn't be in the hands of a regulatory agency. Serious privacy violations should be legislated and treated as outright crimes, not just regulation infringements.
Violating basic civil rights should not just result in the off chance of having to pay a fine. People like Zuckerberg belong in jail way more than the average drug dealer.