Right. I wonder how much the US would pay for this rock I found in Europe? There were no large data breaches while this rock was there.

You can't determine the past effectiveness of increased future legislation, especially if it's in an environment with a history of lax enforcement.