I'm not sure about arresting, but, clawing back huge amounts of the money (particularly any bonuses/options/stock but perhaps not salary). And, as far as fines

I'm not sure about arresting, but, clawing back huge amounts of the money (particularly any bonuses/options/stock but perhaps not salary). And, as far as fines, I think just providing a very simple path whereby they are deemed responsible for losses resulting from the breach is enough. Me having to personally sue them and personally prove their responsibility in a court is a very high bar. A class action is a much lower bar, but, will result in me getting significantly diminished compensation. Some process in-between that where their guilt is established beforehand and I merely need to prove what my damages are and I can collect, say, treble damages from Equifax would fix the Equifax problem in a more egalitarian way.