> no one knows what a typical fine looks like The EU has had data protection law for twenty years. The EU has enshrined proportionality of penalty in all EU la

> no one knows what a typical fine looks like The EU has had data protection law for twenty years. The EU has enshrined proportionality of penalty in all EU law as a fundamental right. There is plenty of case law at the CJEU defining this. All you need do is read the FAQs that EU ICO's have been putting up. The UK has never, in 20 years, applied the full penalty of the previous DPD, and under 0.1% of all reports got any fine at all. A "typical" penalty will be help to comply. Perhaps a strongly worded letter.