> not something you control, but a penalty after action

I’m fine with punishing companies after they violate data protection/privacy laws.

> You also have an agreement with the bank as such

I’ve not read many bank agreements but I don’t believe they say anything like “the bank can’t take my money to the casino and put it all on black”. Yet if they do that they’ve broken the law.