Collective reporting obligations are so easy to just break though. At many companies the process for such obligations is intentionally broken.

I do agree with you that a proper regulatory framework with clearly defined obligations is better than one off overly-punitive fines and arrests.