Have such fines ever been levied in a mass data breach? If not, then they are meaningless.