I don't think it should just be a fine. If I sold you a couch and then broke into your house and spied on you, I'd face some sort of criminal charge, even if I

I don't think it should just be a fine. If I sold you a couch and then broke into your house and spied on you, I'd face some sort of criminal charge, even if I emailed you a fifty page document with a "privacy policy" first. So why not the people responsible for this?