1) GDRP has been in effect since 2018. It doesn't matter that they were in violation of the law "only" two years - they broke the law. 2) Just because they are

1) GDRP has been in effect since 2018. It doesn't matter that they were in violation of the law "only" two years - they broke the law. 2) Just because they are incompetent doesn't mean they get to break the law. Why should incompetent businesses be absolved from any wrongdoing? 3) If they want to do business in the EU they have to play by the EU's laws. If they cannot abide by the EU's rules, they probably should not try to make business in the EU. 4) That's why they only have to pay 2.6%. 5) There were multiple breaches that exposed user's data. You might think that exposing user's data is not that serious, the EU has decided otherwise. The burden by law is with the company, not the parents.