Fines have two different justifications, and I believe you're mixing them up. One is a sort of punishment for what is considered a moral failure. For people th

Fines have two different justifications, and I believe you're mixing them up. One is a sort of punishment for what is considered a moral failure. For people there's criminal law, but when organizations "misbehave", fines are usually easier to assess rather than individual responsibilities. That is the context in which you are concerned about fines, because it seems unjust to punish where no intent to harm (or gross negligence) existed. But fines in this sort of civil law context also serve a different purpose: much like a carbon tax or late fees at the the video rental store, they serve to internalize negative external effects. In this light, there is no moral judgement or stigma attached to fines. Put another way: the damage is already done when the data is lost. All that's left is to assign responsibility. "No fines" leaves all of the burden with the individuals whose data was lost, even though they are unlikely to have any power to stop such breeches. By fining the company (and possibly compensating the victims) the existing damage is only moved to the party that had at least some control over the situation.