What kinds of violations might pass that 1 percent threshold? The massive 2016 Wells Fargo fake-account scandal, which involved company employees fraudulently creating more than 2 million fake accounts in customers' names and which Warren specifically called out as a motivation behind the bill, would certainly fit the criteria. So would the 2017 Equifax breach that exposed the personal information of more than 143 million American consumers. Another candidate for criminal liability under this formulation might be Mark Zuckerberg for his company's alleged negligence in allowing Cambridge Analytica to harvest the personal data of 87 million Facebook users. (The company is currently under investigation by the FTC for potential privacy violations related to how the platform had allowed data sharing with outside developers, which may have violated a 2011 consent decree with the agency).