As usual, "empowering" the FTC to issue fines, or even allowing private suits, is ineffective on its own. The fines need to be required, their levels set by law in a manner proportional to the size of the companies involved, and it needs to be made clear that there is no statute of limitations and that all growth built on ill-gotten gains from past surveillance will (not can) be rolled back when the hammer finally drops. That means, e.g., if you start using surveillance pricing in 2016 and you get caught for it in 2026, everything your company (and its executives and board members) gained in the interim will be rolled back. Current conceptions of punishment for these types of things are simply way too low. The entire tree that has grown from these kinds of activities must be pulled out from the root to adequately deter potential malefactors.