For companies that repeatedly breach, criminal prosecution of the people doing so is probably better than fines.

Absolutely. A pharma company had a representative (either C-level or legal) say in court something like “just give us the fine, we can afford it”. I suspect these companies have that kind of money.