The maximum penalty for violating the GDPR is 4% of worldwide turnover. Possibly stupid question: I keep hearing that this is considered a "high" penalty, but if you're Google or Facebook and this (or any) regulation substantially threatens your bottom line to the tune of more than 4%, wouldn't you just eat it like a tax?