Here is the angle the flat-fine crowd misses: the problem is not the first violation, it is the fifth. The GDPR already uses a two-tier system, up to 2 percent of global turnover for lesser breaches and 4 percent for the worst, which gives regulators room to start small and escalate. GDPR. A revenue-linked scale means a company that fixes its practices after one penalty faces a manageable hit, while a serial offender that treats fines as a subscription fee faces an existential one. Flat fines do the opposite: the giant shrugs, pays, and repeats. If we want fines to change behavior instead of just generating headlines, the penalty has to grow with both the company's size and its rap sheet. Tying the ceiling to global revenue is what makes escalation credible.
Should privacy fines be tied to a technology company’s global revenue?
One FOR case in this debate
Discussion (4)
The escalation point is key. A first-time mistake should not be fatal, but the tenth mistake is a business model. Revenue-linked ceilings give regulators a ladder instead of a single hammer.
I like escalation in theory, but who decides what counts as a repeat offense? A company with 50 products will always have something in violation somewhere. You could escalate forever on technicalities.
Exactly. Right now the rational move for a giant is to violate, pay, and repeat, because the fine is always smaller than the profit. Scaling the ceiling with revenue and repeat offenses flips that math.
Fines do not change behavior nearly as much as people think. What changes behavior is personal liability and product bans. We are debating the size of the check while the underlying conduct continues.