At least in the EU, they run the (qualified) risk of a collosal statutory fine. It wouldn't be easy to get them audited (particularly in Ireland where the Data Protection Commission favours discretion over valour), and they'd have to actually get caught. Assuming that they didn't hide the evidence, and the auditors found it, and the necessary hoops were jumped, it could be financially and reputationally painful, even for big G.