The EU handles fines differently than the US. While the US applies harsh singular punishments early on, the EU gives slaps on the wrist at the beginning but will relentlessly punish companies that repeatedly break the law. This can end up costing companies more than 4% because they will be fined over and over again.

Well, GDPR fines are ramping up over time, regulators seem to have been easing companies into it rather than starting off with the 10B fines from day 1. I still hope to see some serious fines on FB / Google in the coming years.