They can absolutely fine them, and if Yahoo's experience is any indication, fines for this kind of stuff are beyond what billions will cover:
http://www.washingtonpost.com/blogs/the-switch/wp/2014/09/15...
How can you hope to defeat stuff like this in court if you can't survive the fines building up while you're waiting to see the process through?