I agree completely with Jennifer on this one.
Enforcement measures and serious consequences for breaches of privacy need to be taken seriously. The next steps that need to be taken are entirely at the level of senior management being disciplined for allowing these breaches to occur in the first place.
We talk about a culture change. Culture is a very vague thing to change. I think serious consequences for breaches of privacy are, in fact, the steps we need and we need to get specific on what those are each time this happens.