You're mixing up a manually imposed punishment on companies vs exposure/impact, e.g. identity theft.