Does GDPR even allow the 4% fine at first? I thought the point was to start “small” and ramp up if they don’t improve. Because, while GDPR applies to Facebook,

Does GDPR even allow the 4% fine at first? I thought the point was to start “small” and ramp up if they don’t improve. Because, while GDPR applies to Facebook, it also applies to everyone. So that small business down the street may not be able to handle a 4% fine while FAANG could. If a 0.5% fine fixes the problem, then going to 4% is unnecessary and would only serve to satisfy vengeance (which laws are not supposed to do[a]). There’s also the fact that GDPR is a directive. Each state (nation) has to implement it in their own laws. So the EU itself can’t enforce it, only the member states. [a]: The purpose of laws are not to be an “eye for an eye”, but to curb bad behavior (theoretically)