20 million is the max penalty for repeat offenders. See article 83 about fines being proportinate to the offense: https://gdpr-info.eu/art-83-gdpr/

This is a european thing, if any law says $x is the max fine or alike, then for a first time offense you usually get much less.

Nobody will fine an open-source project that amount of money. The goal of GDPR is not to bankrupt anybody but to nudge them into compliance. If you aren't maliciously handling user data, you are not a target of high fines.

First, that is the maximum. Second, no one scare mongered about the old maximum fines of £500k (which BTW were never used).

https://government.diginomica.com/2017/08/10/ico-maximum-fin...

Or 4% of your world revenue whichever is largest.

Then again you can stop brandishing this FUD as this kind of fine is not gonna happen to small actors. If you act in good faith and are found doing something wrong you'll receive a notification asking you to fix the issue.

Why do people think EU is dumb and will start distributing 20M fines right and left at the first offense ? Just look at how it's done up until now and what CNIL said about how GDPR will be applied.

Let's not talk theory. I am making that gamble. Business is about risk judgement, and I have judged the risk to be miniscule.