Hard to imagine this being legal and the fine is a slap in the face of those whose privacy had been compromised.

This should pose as an existential threat to companies behaving like that.