Should privacy fines be tied to a technology company’s global revenue?

Turnover tells us how big a company is, not how badly it behaved. A narrow retention mistake and a deliberate sale of sensitive records should not start from the same revenue-based threat. The GDPR data also show a few regulators dominate the largest cases, so legal exposure can depend heavily on venue. Base penalties on people harmed, sensitivity, duration, and repeat conduct instead.