As predicted by many commentators, #CambridgeAnalytica is going to escape punishment because all the people involved simply formed a new (but legally separate) company:
By going after companies and not people, it is very difficult to enforce privacy laws.
This is a familiar pattern that commercial con artists use: run up liabilities with one company, then transfer assets to a new company. If they get caught, they simply do it again, and it's legal.