Yeah, I mostly used that example since it was a school district so it would be feasible to enact actual policy change that would punish violations internally. I agree that for private corporations this does not work but for public institutions it’s also not as effective of a deterrent as it could be due to lack of direct financial accountability.