penalty increased in data protection law