While my first intention was to set a high penalty too. After a few minutes I thought there might be an alternative. How about prohibiting breachers (companies

While my first intention was to set a high penalty too. After a few minutes I thought there might be an alternative. How about prohibiting breachers (companies which have had data breaches in the past) to collect data which is not essential for their business for a limited time span? Something like: Hey you have not secured your customers data? So why do you want to store that data anyway? You want to promote only the relevant products to your customers? So we will give you some time to get your storage security right and therefore, you are not allowed to collect any non essential data for the next two years. Yes, the essential data is probably the more important one, but at least it would bring companies with low security to store less data for a while. Just an idea, what do you think?