[stadium]

There is a risk that good intentioned regulations become a barrier to entry that only large, well-resourced organizations can meet.

For example, what if "management" is a one or two person startup?

Maybe punishment is not the answer, but rather liability insurance coverage requirements. Or treat it like workers compensation where a small tax funds an insurance pool. And make it so repeat offenders get charged an increasingly higher tax rate.

[pjmlp]

The same issues as one or two person restaurant startup have to deal with, for example.

When kitchen cleanliness, plumbing, food quality and preservation, cutlery, access for disabled people, ... becomes an afterthought, it is time to be shutdown by consumer protection government agency, usually they get one time warning though.

Or maybe not, depending on the country, but then expect what might be great food with interesting side effects.

[c1ll1an]

Definitely true that enforcement has to be proportional to both the infraction and the size of the organization.

However, I would argue that there are plenty of very small companies that also take advantage of that. i.e. very high growth, early stage companies with loads of vc backing that don't prioritize this because they're small and there's only two founders.

All I mean to say here is, again I'm not a regulator, however we do need a way to enforce against bad behavior.

In the 1950's no one wanted seatbelts, not car owners/public or auto manufacturers. Today no one would get in a car without seatbelts without thinking it was weird/crazy. Sometimes we have to enforce rules to drive change, otherwise bad behavior (particularly at large companies) goes unchecked.

[b3morales]

Penalties can be both severe and proportionate to revenue at the same time, as one option.

[c1ll1an]

Right b3morales - they can and should be proportionate to both size of company, revenue and the type of regulatory infraction - all of these must be evaluated but it doesn't mean we shouldn't enforce.

To take the restaurant example, a mom/pops restaurant may have less resource to bear for cleanliness and safety but if it consistently, knowingly persists in doing something that makes it's patrons ill - it is any less at fault than a chain of restaurants that does the same? The fine may be proportional to that organization - that's the goal with the GDPR's revenue % based fine format but it could/should go further for large companies that consistently fail.