I asked what other enforcement mechanisms there could be since an added fine isn't really teeth-y enough unless it follows the EU model for privacy violations: initial fine and a requirement to change behaviour, no change in behaviour increases the fine up to 6% global revenue, and the fines will keep coming until the behaviour is changed.
Perhaps for the company you work at it might not be worth it but we are talking about one of the most profitable companies in the history of mankind.