This is a very specific statement. It may be true. But, even if we accept for the sake of argument that it is, it's not quite the same statement as, "Mass personal data collection has never resulted in personal harm," which, while seeming quite similar, also happens to be false.
Well, Yahoo's publishing of supposedly "anonymized" data still poses a privacy risk to any of their users: https://www.vice.com/en/article/yp3d8v/yahoos-gigantic-anony...
That's just one of many apparently "anonymized" datasets that has been trivially deanonymized by researchers/hackers/internet-stalkers; so there's plenty of harm to be done.
I also can't see attitudes like that changing until companies that collect data are seriously held to account for any leaks/abuses of the data that they collect.
Potential penalties would probably have to include criminal charges, in much the same way that individuals and companies can be held criminally liable for mishandling toxic waste.