I think you have misunderstood how the maximum penalties work under the GDPR. In any case, it makes sense that those maximums would be used only in the most se

I think you have misunderstood how the maximum penalties work under the GDPR. In any case, it makes sense that those maximums would be used only in the most serious cases of wilful violations. I wonder whether internally at the ICO they might be waiting for a chance to make an example of one of the tech giants whose whole business model, unlike the organisations penalised so far, is based on exploiting personal data in questionable ways.