Lol? This is unfair, First of all what do they mean by prevent data leaks?.. You cannot 100% prevent data leaks because everything has a vulnerability, every company has it own loopholes, eventually each one of them is vulnerable to this attacks. What i'm sayin is, do not just fined them if they failed to prevent these attacks, but fined them if they don't do something after these attacks.. i.e what happens next after the attack, what precaution should they do in order to lessen the damage that happen. Most Companies only invest in preventing measures or most of their goal is to prevent an attack, this thinking is reasonable but what will happen if they fail to prevent the attacks? what will they do about it?.