Fines are up to $10 million or 2%, but it can go up to $20 million or 4% of annual global revenue, whichever is higher. That percent, whichever is higher is the key. Facebook's 2017 revenue was ~40.7 Billion. Four percent of that amount isis ~1.6 billion
> if they don't win (with infractions being $10 million minimum
But all of the numbers you give are the maximum possible fines. The actual fines imposed by the regulators will always bee smaller than that.
You also said:
> The citizen who filed the complaint would enlist help from a no-win-no-fee legal firm,
That's not how the fines work. They're fines, paid to the regulator. They're not compensation paid to the victim. There's no payout for no-win-no-fee solicitors, and so they're not going to get involved.