Punishment after-the-fact to statistically disincentivize behaviours we want to disincentivize. It doesn’t prevent the thing from happening ever, it just makes it so that when it does, inevitably, happen, the system pushes back against the offender. This makes rational actors less likely to do things they could be sued for. But 1. not all actors in a market are rational; and 2. sometimes it’s rational to be “evil” if the upside is large and the chance of getting caught is very small.

Consider also: traffic laws. The punishments make most people obey them. There are still drunks, malicious drivers, just plain bad drivers, and people doing U-turns on the highway when they think no cops are around.

If you want an assurance that you won’t be hit by one of these, you have to just avoid traffic altogether.

If you give someone else an assurance that e.g. their child will never be hit by a car, then you have to never take said child on the road.

Facebook gave an assurance that our data would never cross paths with a bad actor. The only way to do that is to never take the data to where the bad actors might be.

In theory, discourages certain behavior with the threat of legal action. In practice, this doesn't work sometimes for various reasons. What if you're 95% certain you have the resources to crush your opponent in a legal battle, still profiting handsomely net of the legal fees you incur?

The law does not prevent anybody from murdering you with an axe. The law forbids people to murder you with an axe.

Once you understand the distinction there, you will understand the answer to your question.

The agreement is between FB and the next party. If FB is suitably embarrassed, they can go after the next party.

That doesn't help the users much, though.