I think your questions come down to general European v.s. US jurisprudence. > If Alice mishandles Bob's property, > why is Charlie getting paid for it?

I think your questions come down to general European v.s. US jurisprudence. > If Alice mishandles Bob's property, > why is Charlie getting paid for it? If Alice and Bob both join Fight Club and have a consensual fight and one of them dies, even in the US the survivor will be charged by the state for that. The reason is that certain violations aren't simply seen as person-to-person violations, but disturbances of the general order that have ripple effects on the rest of society. European countries in general are more prone to seeing something like the violation of business law as being a crime against the state, not just a violation of the specific people who were victims in that specific instance. It has upsides and downsides, but I think in general it's better than the US system. American companies tend to have to worry about compliance with regulators and the possibility of huge payouts from court cases filed by individuals. If you have a small company and screw something up (but not much more than other companies in general) you can go bankrupt mainly due to bad luck. In Europe companies tend to mostly have to worry about just the regulators and the state, except in cases of gross negligence, which makes it easier to predict when you need to be compliant etc. There's also the practical matter that the state has a lot more leverage against the likes of Facebook and can exercise collective bargaining. You can see how well this "your personal information is your property" idea is going in the US with the likes of Equifax, Facebook etc. In practice the little guy just has to eat the TOS of these services and doesn't have anything like a property right over his information. As to your question of whether some companies will simply eat the 4% fine. We'll see, but that's a topic unrelated to who the fine is being paid to. If some company like Facebook were to publicly flaunt the GDPR you can bet they'll find something else to charge them with. The GDPR isn't the only privacy regulation in effect, there's also various national regulations that could be brought to bear. The threat of the 4% fine is mainly intended as a big stick to bring companies into compliance.