> the only results is the enforcement of existing law and some fine? The job of European data protection agencies isn't to be punitive, but to ensure complianc

> the only results is the enforcement of existing law and some fine? The job of European data protection agencies isn't to be punitive, but to ensure compliance. If the issue was tiny, an honest mistake that was promptly fixed when it was brought to the offender's attention, and they show that they implement safeguards so that something like that won't happen again, there may be no fine at all. Compared to this, EUR 50M is rather heavy handed, but given that Google has approximately $infinity at their disposal, no value would "ensure compliance". What this does is ensure that the topic will be discussed by the board of directors (50M is probably beyond the discretionary spending budget of the not-quite-top level manager who handled this) with the outlook that there may be more fines like that. OTOH it's still far from that "4% of global revenue" figure, so it gives room for escalation. Hopefully it's also small enough that it won't be disfigured too much into "the evil EU is being protectionist again!" US press cycle that comes up every time a US company is fined by some EU body.