GDPR enforcement is 15 months old and regulators aren't the fastest bunch. They're also cooperation based as the goal isn't to serve fines but to ensure complia

GDPR enforcement is 15 months old and regulators aren't the fastest bunch. They're also cooperation based as the goal isn't to serve fines but to ensure compliance: If you cooperate, you might get away with no fine at all (depending on circumstances). Also the 4% global revenue fine wasn't exercised yet because it's the maximum fine, and there needs to be room for escalation: hard to serve a bigger punch if you're already at the maximum.