Right, in the same way that making it illegal for cities to pay would. Probably wouldn't stop normal people paying but they don't have $400k of data to steal.
It is not the same as the city essentially is put in the situation were they need to choose between losing data and paying both a ransom and a fine (unless you want a federal agency to freeze ALL city controlled funds).
If you want to stop city from paying the the law need to state that even if they get their data back they need to delete it.
So I'd say it's exactly the same.