Same as with banks: de-risking is the key to keeping this cheap. If someone doesn't like you, they mass report you and the company just closes your account. Presumably there's only fines if a company fails to act and no damages have to paid for false positives.

And - if the law requires it - they'll also send your full dossier and personal details over to law enforcement. Maybe they don't open a case on you, but now you're "in the system" and find yourself stopped and frisked more often. It's not as bad as swatting in the US though.