This is what I thought about the 23andMe debacle. They may should have done better, but any attempt to "punish" them really feels like ex post facto law. Make new regulation or something and punish future incidents, but not this one.