Should location privacy violations trigger automatic independent audits?

Automatic remedies ignore the facts. A one-time vendor configuration error should not trigger the same 20-year burden as deliberate sale of clinic visits. The Outlogic order required deletion, consent, a sensitive-location list, and a privacy program tailored to the conduct. Regulators need room to choose the remedy that closes the actual gap.