That's a different issue, though. In your example, the company is actively doing something malicious, and accepting the fine for getting caught as part of thei

That's a different issue, though. In your example, the company is actively doing something malicious, and accepting the fine for getting caught as part of their costs. Other than the threat of a really huge fine (or worse sanctions), they're unlikely to stop. In this case, it's a company that's not actively trying to be malicious, but rather due to [cost-saving/incompetence] has underfunded IT security to an excessive degree. For them, and others like them, to change their ways it's a lot less self evident that the fine needs to be huge. The fine (and accompanying reputational damage) just needs to be enough to make them, and similar companies, take IT security seriously. Very different situations, really.