You can penalize people as a method of enforcement.
I think the problem I have is that in the current act, if you look at the sections on use, retention, and collection, it is so vague. That's why I'm saying you have to build that act up. You can't be explicit in everything, but transborder data flows? Come on. We've had a history of these. If we can identify them, we can anticipate some. If we don't build in some explicit language in that regard, what are you going to be enforcing? You have to have much more of what these things are: metadata, biometric data. You have to have some degree of the content there, so that you can then enforce it.