Then you get people on HN shouting "regulatory capture!" and "stifling innovation!"

It's also disproportionate. If my email is leaked in the context of receiving treatment for a stigmatized disease, that's a lot worse than an MMORPG leaking my real name.

Maybe some penalty is necessary but $10k or above per user is disproportionate for the vast majority of people. A $50/person penalty with gradations for sensitivity of the information is going to work better in practice. If leaking an SSN is more expensive than an email or site-specific ID, corporations might stop using SSNs to identify people to reduce their exposure

If the outcome of ignoring data security is to not make any money then companies will actually do something about it.

Penalities should push the company to the point of failing.

You phrasing it like this is not a substitute for explaining why it wouldn't be those things.

Also, the most obvious thing is: if you're a healthcare provider, you would probably hire some hackers to go after your competition, and let heavy-handed fines take them down. Much easier than providing better value.