I think the bigger problem in the US is that there really aren't standard fines for mishandling or purposely misusing customer data similar to what is structure

I think the bigger problem in the US is that there really aren't standard fines for mishandling or purposely misusing customer data similar to what is structured under the GDPR in Europe.