The proposed penalty, for a breach that exposed the data of 500,000 customers, comes under Europe’s landmark privacy law.
