Even in cases where a company causes death, or destruction and the company is found liable, employees are not allowed to be used as standins, employees need to be convicted as well. a conviction isn't fungible, that kinda the point of common law.
I mean yes, if you have a large well funded company that brings profit to said country that is how common law works.
In the US for example if you happen to bring gambling funds to some other country from us citizens you will be arrested in very creative ways while not even getting close to the US.
At the end of the day all law is what the government wants to do and can get away with. When it comes to not actual citizens of the country they tend to get away with a whole lot more. Or another more simple way to put it, "You can beat the wrap, but you can't beat the ride".
I mean its not. Because this is data protection laws, the company is liable, not its employees. (https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re...)
Even in cases where a company causes death, or destruction and the company is found liable, employees are not allowed to be used as standins, employees need to be convicted as well. a conviction isn't fungible, that kinda the point of common law.