> Penalties don't work for government agencies. Taxpayers would pay for it and it doesn't act as an incentive.

This is the same as the rogue police problem in the US. What needs to happen is a shift to personal liability for those responsible.

Personal liability? Are you also against no blame culture that is prevalent in the tech world?