Punishment after-the-fact to statistically disincentivize behaviours we want to disincentivize. It doesn’t prevent the thing from happening ever, it just makes it so that when it does, inevitably, happen, the system pushes back against the offender. This makes rational actors less likely to do things they could be sued for. But 1. not all actors in a market are rational; and 2. sometimes it’s rational to be “evil” if the upside is large and the chance of getting caught is very small.

Consider also: traffic laws. The punishments make most people obey them. There are still drunks, malicious drivers, just plain bad drivers, and people doing U-turns on the highway when they think no cops are around.

If you want an assurance that you won’t be hit by one of these, you have to just avoid traffic altogether.

If you give someone else an assurance that e.g. their child will never be hit by a car, then you have to never take said child on the road.

Facebook gave an assurance that our data would never cross paths with a bad actor. The only way to do that is to never take the data to where the bad actors might be.