Also no you dont need to consult lawyers when writing code. You just dont track and save data and do questionable stuff with it. Saving passwords in logs is surely security issue first before its GDPR issue.
Plenty of foreign newspapers block the EU from accessing their sites. The EU is not that a big market.
Do I think we should punish companies for storing passwords in plaintext? Yes. Would I expect that a bug and devs untrained in GDPR best practices could lead to fines? No.
Usually in software engineering you don't get your company fined for making terrible mistakes unless you're in a field like finance. This was just passwords which most sites have, not something like PCI DSS stuff
Which is exactly why companies don't care, which is why this regulation was made and those fines decided.
> Usually in software engineering you don't get your company fined for making terrible mistakes unless you're in a field like finance.
You're not fined for a mistake, you're fined for a mistake AND that mistake huer the customer more than you AND you don't disclose it swiflty to him.
The penalties are based on percentage of turnover.