it is illegal and it is being enforced

https://www.techradar.com/news/avast-hit-with-multimillion-e...

Being enforced after it is too late to do anything about it. The people that did it made their money and the data is long ago sold.

How do you suggest it be enforced prior to it happening?

Make it so that if you get caught doing something like this, then there is no company to reform its image. Fine it 150% proportional to the value of all its assets, then judge every CEO and boardmember in charge during the events ineligible to work in that industry ever again.

Then we will see if it another company finds that it is worth it to make a few million in profit selling customer data.

The history of law counsels against draconian punishment. There is a sweet spot between lenience, where crime is not deterred, and sadism, where crime is worth expending any and all effort for all even tangentially involved to cover up.

It’s tempting to give into Prohibitionist methods, so we see these proposals come up continuously. But proportionality has a purpose.

You make a great point. I suppose the trick is finding something that hurts enough to make it not worth it to try, but isn't draconian.