I got the same impression while skimming over a bunch of meagerly fines of a couple thousand euros. But then I saw the graphs https://www.enforcementtracker.com/?insights which might inspire most trust. Maybe DPAs are slowly learning and improving their process?

I know that I tried to file a complaint in Romania back in 2019 and it was a huge hassle to do, with a large form with all types of info I didn't have easy access too (like the onus was on me to provide company information, contact details, etc). Whereas when I checked out the complaint form this year it only included a few fields, that made sense.

In the case of Denmark more than half of those were governmental, which generally have less skin in the GDPR game, and out of those left only two of them made me think wow I bet those guys have enough money that these fines won't be more than an irritant and one of them was a non-profit.

Aside from all that if I was one of the people handing out fines my thinking would be like this, first I would ramp up so start giving smaller fines, and then when people I was fining were not changing their behavior I would keep increasing the fines. If for example someone gave Arp Hansen Hotel Group A/S a significant percentage of its revenue as a fine the first time people would be up in arms and complain a lot, so then I give them a slap on the wrist of 147,800 euros - which in the average Dane's view would sound like a lot - and ramp up the next time to maybe 220000, then the next 400000 - and then if they keep on give them a million. At that point no matter what PR campaign is done to make them seem the victim it will be a hard sell, they were warned fined multiple small fines and never fixed up their act. Who can blame us?

At the same time I would also want to keep my view to what people were giving national and international bad actors in other countries, I would want my actions to look reasonable in relation to those.

Speaking of which I saw

Ireland: Fine against WhatsApp Ireland Ltd in the amount of EUR 225 million

The Irish DPA (DPC) has fined WhatsApp Ireland Ltd. EUR 225 million for breaches of the GDPR in relation to the provision of information and the transparency of that information to users and non-users of WhatsApp.

And

Luxembourg: Fine against Amazon Europe Core S.a r.l. in the amount of EUR 746,000,000 In its quarterly report, Amazon.com Inc. announced that the DPA from Luxembourg (CNPD) had fined Amazon Europe Core S.a r.l. EUR 746,000,000 for failing to process personal data in compliance with the GDPR.

These are also relative slaps on the wrist, but of course the problem for these companies with these fines is that just one fine might be a slap but 20 or so and you might start to get a welt on that wrist.

at any rate - I would not expect anyone to issue a fine of of 4% of annual global turnover – whichever is greater - the first two or three fines that are given out to any company - unless Facebook has some leak that shows them spelling out their plan to break the law and do what they want with EU citizen data because screw the EU!

>full of fines that each amount to less than two months pay in most cases of a single employee.

Aside from the municipalities / regions, I see two companies that had fines small enough to be possibly two months pay of a highly paid employee, the other ones sure maybe if we're talking at top management levels but that's sort of misleading. At any rate it's not two months of a janitor's wages - unless we're talking about the municipalities.