3 ms·

I think it was a balancing act. Currently in the UK, the Information Commissioner's Office can fine up to a maximum of £500,000. The concern was that for larger

I think it was a balancing act. Currently in the UK, the Information Commissioner's Office can fine up to a maximum of £500,000. The concern was that for larger organisations, the cost of compliance with the Data Protection Act (1998) was higher than any potential fine handed out by the ICO. So by placing the limit at 20m Euro, or 4% of annual revenue, they give the legislation adequate 'bite' to persuade boards that investing in systems and people to ensure data privacy is upheld is worth it. However, the EU doesn't want to drive business away entirely, so the figure was selected to ensure that it was punitive, but not to the point where organisations would seriously consider shutting down in Europe, or restricting services to European consumers.

smueller1234 9y ago
Do consider that they can also shut down whatever operations they consider to be in violation. For example, if you're in e-commerce like my previous employer, then having your website/app channels shut down while you implement some bizarre scheme can cost you even more than 4% of your annual revenue. For a big, established company with byzantine operations and large code bases, being caught entirely unprepared can mean a mountain of effort - months - to become compliant. (And I haven't checked but I imagine it's past year's revenue that is used for the calculation so the double whammy doesn't even get reduced by being shut down.)