Just to elaborate a little bit and maybe take it to a slightly different place and come back to some of the things we were talking about before, one of the advantages of having penalties is that penalties generally are reported: company X was fined by the Privacy Commissioner. It's not just the monetary hit, but the reputational hit. Companies that have bad practices and bad procedures will have to pay a price for it. They will pay the price in terms of the fine, but they will also have to pay a price in the marketplace. As for deals with the private sector, companies don't want to be obviously and consistently deficient in protecting the personal information of their customers.
On March 10th, 2015. See this statement in context.