This is why GDPR fines, say, are a percentage of _revenue_. Harder to mess with without getting into outright fraud.
Yeah agreed this seems more directionally correct.