I would advocate not only for fines, but companies should be required to pay compensation to people affected by the leak. To the extent that if someone address got compromised, Facebook would be required to relocate that person / family to a new address of comparable standard.