Nobody is likely to catch corporations obtaining or holding information on just a few people they have some special interest in.

They wouldn't even have to store that info in their regular systems.

But making it unsustainable for them to make a habit of it, which is something that impacts millions of people, is possible, with escalating fines.

Also, it doesn't make sense to say a business will just take fines as a cost of business, without taking the size of fines into account. Clearly there is a number that they will respond to, because that is what they do. Respond to hard currency numbers in whatever objective way will let them maximize what they keep.