Wrong approach
The Dutch authorities are working with the corporation to fix the situation, and are using the threat of a fine as a stick to make it happen.
That's entirely the wrong approach to take.
Step 1) Big fines now. Make sure MS and others know they can't keep flouting the laws and then expecting governments to bribe them to fix it later. Make breaking the law hurt, like it does for the rest of us.
Step 2) Continuing painful fines until it is fixed. Arrest warrants for relevant executives should they take too long to fix (eg "not fixed after 48 hours"). Also, make the warrants remain until the issue is fixed even if the exec retires from the company. If, for some reason the exec needs to travel for some meeting, let them travel but on strict conditions and with 24/7 chaperones (who have the power to arrest them) that the execs themselves have to pay for. The chaperones can stay outside of meeting rooms so long as they can confirm before hand that all possible exits are covered.
Step 3) IF and when the issue is decently fixed, end all sanctions.
For too long these types have been able to get away with massive crimes without punishment.
Biting the hand that feeds IT
