Compensation?
If it was £100 to £100 per person, you'd see more secure sites and less spam. Fines for data breaches and cold calling are barely a blip, negligible. Adverts are worse. Usually a virtual slap and told not to run an ad that probably ceased months ago.
It needs to be top management, boards and shareholders that are fined, not the companies as that is simply penalising customers. Esp. bad when it's a Council, school, health etc.