It would be like fining the victim of home burglary who stores data about their neighbors for profit. Mandatory business data leak should be exempt but everything else should be a liability. If they save cc info by default (opt-out) that should be a major liability.