This is much more important than the fines. But really it should be widened to include not only those who made the decision but also those who implemented it (software developers, designers, project managers) and those who benefited from it (executive officers, shareholders).
Anyone involved with the company who knew what was going on and did nothing to hinder it is culpable to some degree.