Fines for these kinds of things don't work. They just get factored in as overhead. Penalties should effect people not budgets. Nobody would be lax with security if administrators went to jail every time there was a data incident on their watch.
There needs to be real audits, with teeth, of computer security stuff - audits run in an adversarial way without the issues involves in financial audits. If you pass the audit, the fines should be minimal in the event of a breach.
It's hard to imagine anyone with half a brain working under such conditions.
It's also hard to imagine that putting such a measure in place would not result in data and systems being so locked down that they become unusable to most staff.