Which is at least a factor 10 too low under the assumptions that fines of that size are the result of a lengthy legal process and thus that such fines are not l

Which is at least a factor 10 too low under the assumptions that fines of that size are the result of a lengthy legal process and thus that such fines are not levied more than once every few years. 4% is peanuts for a massive tech corps that can afford to take such massive hits because their margins are so huge, and their fixed costs quite controllable. As long as the risk cannot be existential, this becomes an accounting question, and the inevitable rarity of the fine unfortunately means the optimal strategy is likely to skirt as close as possible to illegality and pay the fine and ask forgiveness rather than being too proactive - that way they only need to bother with behavior changes that really matter. 4% is just too little for large corporations, at least. Then of course there's the fact that the GDPR - possibly due to a bit of regulatory capture - very strongly encourages venue shopping, and with resources like that, bending a small venue (like Ireland) to your will even slightly is conceivably feasible, and valuable. Personally, I'm not too impressed by the implementation of the GDPR, even if the fact that it's finally on the agenda is a good thing. It may even exacerbate misuse of personal data, because the burdens it imposes are much harder to bear for small parties than for large ones; and that's a competitive moat that encourages centralization of private data, and that encourages shifting the balance of power toward the corporation away from the individual (who says no to google's privacy policy?), and the combination of "willing" users, a lax privacy policy, and huge centralization encourages misuse. Proportionally your local sports-club is likely more impacted than Google, which is absurd.