I wouldn't think there are any legally enforceable penalties except maybe through contract law. PCI-DSS is not law, it's an agreement between companies.