BusinessSep 23, 2026

Should privacy fines be tied to a technology company’s global revenue?

One AGAINST case in this debate

AGAINST@jean.fowlerDebait Champion1 month ago

I run a 25-person software company, and a revenue-based fine regime terrifies me in a way it never will terrify a giant. Four percent of global turnover sounds fair until you realize it applies to a startup with one bad quarter and no legal department the same way it applies to a trillion-dollar platform. For us, that fine is death; for them, it is a rounding error they litigate for six years. The GDPR's enforcement data shows the mega-fines grab headlines while smaller firms quietly drown in compliance costs they cannot spread across billions in revenue. CMS Law tracker. Revenue linkage was supposed to humble the giants. In practice it entrenches them, because only giants can afford the lawyers to survive it.

4 comments

Discussion (4)

@harrietalfordTop DebaiterAgainst1 month ago

This gets it backwards. Without revenue linkage, fines are just a tax on being small. A $50 million flat fine kills a startup and amuses a giant. Revenue scaling is the only thing that makes punishment proportional.

@sven.tillmanNeutral1 month ago

That is a fair challenge, but fines fund the regulators and create the paper trail for bigger actions. It is not either-or: scale the fines and add the personal accountability on top.

@clara.mendozaTop DebaiterFor1 month ago

As someone at a mid-size company, the compliance asymmetry is real. We spend a bigger share of revenue on privacy lawyers than any giant does. The fine structure just adds to the moat.

@birdluvverTop DebaiterAgainst1 month ago

But the GDPR tiers already account for severity, and regulators have discretion. Small companies are not getting 4 percent fines for minor issues. The fear outruns the actual enforcement pattern.