[dwild]

The things is, laws aren't whims.

Law shouldn't be applied based on the opinion of some bureaucrats. That's how you get a tiny fine for a big multinational because "they are responsible for too many jobs" or the classical one "their lobby pay me well enough" while the tiny startup get a too big for them fine because, who cares.

Can't we both agree that this fine is WAY too small? Can we both agree that this fine would be WAY too big if it was for a tiny website with a few hundred users?

The idea behind GDPR is amazing, I agree with the concept. What I disagree with is the execution and that fine is the proof that it's pretty badly done.

[dvdgsng]

yes, i agree with both of your statements. :) As far as i understood (correct me if i'm wrong pls) the GDPR fines apply to each single violation and depends on the severity of the violation, so having a big range makes kind of sense, IMHO. I don't know if that applies to this case, though.