I think fines are important. There's a lot of focus in this legislation on providing the commissioner with fining power, but fines are so 20th century. Although you need to have fines available for the worst cases and for the bad actors that continue to contravene the legislation, what's more impactful and where I see more modern tools are things like stopping processing orders or the disgorgement of data. This would mean that a company can no longer use its algorithmic models, that it has to destroy data that was fed into a model, because it was collected illegally.
We see the Federal Trade Commission in the U.S. using these kinds of powers. You see that happening in Europe and the U.K., because at the end of the day what is most impactful for significant contraventions of the law is what actually impacts a business model, and not a fine that is just the cost of doing business.
I think there's a rethink that's needed to give the commissioner modern tools, and I look at fines as a last resort.