Fines and jall time (occasionally) for information security failures are:
Generally, only applicable when a person or organization violates state laws.
Generally, very small in quantity and almost never applied.
Generally, only applicable when a person or organization violates federal laws.
Generally, only applied for serious, deliberate misuse where someone
intentionally accesses data in order to do harm or for personal gain.