That would assume the law wasn't subject to regulatory capture. In theory high fines exist, in practice they really don't. See the debacle with Equifax and not having any real money in the fines to make people whole for their wholesale credit history being breached.