@Tryphon Same as for just about any infraction / misdemeanour / felony / etc: by getting caugh or at least exposed.
Of course, one needs to catch or expose them. But that's nothing new: every legal system on Earth, and probably elsewhere, relies on the infraction etc. being discovered. At least, now, when some company handles our data carelessly, said carelessness is a breach of law -- that's some progress.