• The EU knows fines of ‘up to’ 4% of revenue for privacy violations, which means the company still gets to keep 96% of whatever it’s made by breaking the law. The fine should be a minimum of 50%, plus jail time for the managers responsible. Any punishment that does not make the shareholders cry with fury is too low and will do nothing to change the situation.