Fines and jail time $($occasionally$)$ for information security failures are:

Generally, only applied for serious, deliberate misuse, where someone intentionally accesses data in order to do harm or for personal gain.

Generally, very small in quantity and almost never applied.

Generally, only applicable when a person or organization violates state laws.

Generally, only applicable when a person or organization violates federal laws.