It's not much of a fine if it's fine with them

from here and here

Thousands of unencrypted hard drives and tapes full of millions of customer records, and Morgan Stanley only has to pay $35M to make up for failing to wipe them before they got sold off to 3rd parties. That's maybe a couple dollars per affected customer. You'd think a financial institution of their calibre would be able to afford a couple more zeros.