> fines and class action lawsuits

But they discourage similar behavior in the future, no?

Only if they're actually substantial enough to hurt the company, otherwise they're just a cost of doing business.

Not really. The shareholders are the ones who ultimately take the hit, not management. So unless there's a shareholder revolt, or the board starts firing people or clawing back compensation, the people who actually make the decisions feel no negative consequences at all.

There is always consequence. You only see the dramatic ones from outside.

Really? Can you show me even a single example of a senior executive having their lifestyle meaningfully impacted? Having to downgrade to the next smaller size of private jet doesn't really count.

What if management was fined through increased income taxes in some way? If structured right, it would prevent a 5 million personal fine to a CEO being made up with a 5 million company bonus.

For example: limit the ability of executives to sell shares of stock they receive as compensation, requiring a delay of five years or so.

Until CEOs are personally liable for >100% of compensation amount in cases of gross negligence, corporate malfeasance will continue to be rampant.

Not going to happen. Or should I say that you'll have no applicants for your next CEO opening.

How about prosecuting the people exfiltrating the data? Seems like they should be 100% liable for their actions.