@cstross
You can fine them per offence as long as the size of the fine multiplied by the probability of enforcement is significantly higher than the profit that's possible to achieve from the activity.
Companies tend to be good at optimising for profit. If breaking the law will bring in $X/year and comes with fines that average $Y/year (including inconsistent enforcement), then they will break the law if X>Y. If Y is 2X, they probably won't break that law at all, and definitely won't do it very often.
This is why I was initially optimistic about the GDPR. Fines expressed as a percentage of global turnover can easily exceed global profits and can be scaled to ensure that the violation is deeply unprofitable.
Unfortunately, the probability of enforcement has been so low that it isn't working.