Haven't companies like Google been fined enough in the past alerady and despite that they have made little effort to conform to the data privacy measures? Instead they have enabled alternative ways for tracking (eg. recent FLOC debate). Once the right to privacy (online or otherwise) becomes fundamental, such violations of privacy, consciously or otherwise, by the private companies will fall into illegal activities prosecutable with imprisonment like it is done atm for insider trading and so on. This will create a substantial sense of responsibility in everyone working on any aspects of user data.
The lack of a direct way to measure how much profit in $$ a company made in the past decade because of a single privacy violation makes it an arduous task for prosecuting agencies to decide the amount of fines and/or prison time.
A multivariate regression using do-calculus might help, could be an interesting graduate project.