Under the current framework, there is no mechanism to claw back profits obtained through illegal data practices, allowing malicious operators to retain their illicit gains.