Comment by kevincox

So fine them 100x the value they have obtained. Now unless they are 99% sure they can keep it private then they won't do it.

Although I still don't want them doing it if they think they can keep it safe, so may be make fines for just collecting it without opt-in consent.