One example that's actually undergone a good deal of investigation worldwide would be https://www.nytimes.com/2013/04/23/technology/germany-fines-...

> did they get punished for that

Not really, unless a fine 0.002% of their revenue counts.

> and change their ways?

On that specific issue, after being investigated for it, it seems so. On any other handling of personal data, one can only make assumptions based on their ethical record.