They are expecting to get penalties for their privacy violations. Why would you not hold this against them?