Up to €20m includes the figure zero
Whilst many are applauding the new higher penalties available under GDPR or the UK equivalent, it is worth stopping to ask whether the actual fines will differ by very much from the current regime. A quick perusal of ICO enforcement shows that they have very rarely (maybe never) issued even the £500k fines that they could. The highest instances I could see over the past few years were to TalkTalk (£400k) and a similar amount to a spam caller, Keurboom Communications, who were wound up by the owner a month before the ICO slapped them with the penalty. And the "civil monetary penalties" just go back to the Treasury. So three points:
1) ICO haven't seen fit to reach the pretty low £500k even for the biggest UK breaches. If they aren't seeing those as even half-mill offences, why will a higher penalty ceiling make a difference? Even with a 4% or £17m maximum, what would the ICO actually fine say TalkTalk for their most recent screw? My feeling is of the order of what, £6-7m. Peanuts to them, still. I really don't think we'll see the 4% of global turnover actually used, which would be £70m for TalkTalk.
2) The bottom-feeders can be smacked with proportionately high fines, but they simply aren't going to pay them.
3) Government actually stand to make money from data breaches. That's wrong - the money should either be handed out to the victims (mere pence, but the cost of doling it out would be a huge overhead and massive and embarrassing admin task for the guilty); Or it should fund the ICO's operations, so that they can do a better job of policing the rules, such as proactive investigations.
So I think that post-GDPR it is business as usual for the likes of TalkTalk. GDPR breaches will be more expensive, and hopefully the threat and the publicity will provoke action, but I don't believe the actual fines will be of material significance to larger corporations. Government have talked about making directors personally liable for unpaid penalties, but unless the UK implementation of GDPR includes that clause, no new legislation will be coming forward, and we'll continue to see the scum evade the fines they are due.