It is not the same as the city essentially is put in the situation were they need to choose between losing data and paying both a ransom and a fine (unless you want a federal agency to freeze ALL city controlled funds).

If you want to stop city from paying the the law need to state that even if they get their data back they need to delete it.