Heavy fines
Either bankrupt the company (fine is 20% of yearly revenue) or jail the executives and everyone responsible.
These aren't human beings. These are corporations: inanimate, unfeeling entities worth billions of dollars whose only point in existing is making money at your personal expense. They should think 10 times before engaging in any destructive behavior such as "leaking" patient data to advertising companies. If they're not afraid, then the fines aren't high enough and must be increased.
Of course we’re finding out repeatedly that no threatening fines don’t prevent that behavior either. :/ there’s a theoretical fine line where just enough fines will prevent such behavior but frankly I’m having a harder and harder time believing such rhetoric.
Maybe it’s the ownership of such companies that are wrong. I highly doubt Cerebral would’ve made this decision in the first place if it was owned by regular people, especially regular mental health professionals.
An uncle of an ex-girlfriend was put in jail for a MITM scheme in the construction bussiness. He was active for about 2 years until they got him. When I heard an estimate of how much he made, I went ahead and did the 24/7 hourly rate calculation for his jailtime. It was a 3 digit figure.
The greedy will just find ways to hide their greed.
In Burundi you'll probably just be captured and murdered.
The USA has very high recitivism when we throw ex convicts out on the streets homeless and broke, which is not a punishment, it's just piss-poor social management.
Norway has one of the lowestest recitivism rates in the world. They combine just punishments with actual correctional assistance for reintegration into society.
Punishments with real correctional assistance and social resources is a proven successful combination.