Unless the fine is implemented as a percent of revenue, market cap or the like. Similarly, the US government once threatened to fine Yahoo $250k per day for non-compliance with PRISM. [0]
As an aside, what do you think is draconian about such a law? It seems like there are reasonable arguments for why it would be in the national best interest to keep an ongoing investigation classified. In fact it seems like an unusually straight forward application of the cliche justification “for national security reasons.”