Heathrow Airport fined £120K for serious failings in data protection practices

But I agree, £120k seems low.

Note that the security stuff makes nice headlines and is concerning, but isn't responsibility of ICO, so likely played no role in their fine.

Think of the money saved by not training 6370 staff in data protection and not having any kind of enforcement of policies.

The minimum wage in the UK is now £7.83 per hour. Assuming it was £7.50 at the time, and that data protection training takes a couple of hours with no other costs, then that's about £95,000. Add in admin, national insurance, mandatory pensions and such and it's got to be about break even in a year. That's before we factor in staff turnover.

Under the Data Protection Act 1998, there were cases where it clearly paid to deliberately not comply.

Will a data breach make people choose to shop elsewhere? People already go out of their way to avoid Heathrow if they can, so any reputation loss is negligible.

When you're looking at big business? Nah. They're not threatened by it: if the fine is too high the law doesn't get passed or it loses its teeth, because it's still cheaper to lobby for leniency. So you get a maximum threshold for a fine that is still pathetic and even further is likely never to be used. If that doesn't work, the business is big enough to threaten the government in power with an even greater loss by opting to dodge tax or shift operations elsewhere. Most of this legislation can be hacked through maths and clever accounting, or ultimately you just pay the workers less and increase the prices.

Most businesses exist to make as much money as they can and you'd think that it would make it their most vulnerable spot, so you can hit them where it hurts. But it doesn't play out that way.

It's essentially a monumental legal cop-out because there's no use holding the corporate entity itself accountable, because the corporate entity is pumping out money to the board no matter what. And we even recognise it as such by referring to such companies as having limited liability. Somehow the owner of a small business can lose their house and car if they fuck it all up, yet those in charge of a much larger company have an incredibly cushy layer of protection when they can deal infinitely greater damage when they put money above all else, sometimes malevolently so. Surely those liabilities should be reversed and the small shop should benefit from the protection from fucking up?

Or maybe one day data transfer will be like money wire transfers. Fill out some paperwork, pay $30, you’ll get your data on the other end...

All data will be owned and custodied by government and data banks. One problem is data is much less fungible than money.

More specifically, we know that people use USB sticks to transfer data, even across "secure" air-gapped systems. (Eg, Stuxnet.) Some organizations will even fill USB slots with glue to prevent this sort of use.

By comparison, the rate of espionage/information theft through physical access to the data is much lower.

Since you posit a rare occurrence - information theft - followed by an even more rare scenario - losing the information - I can easily conclude that it's very unlikely.