From May 2018 in the EU the maximum fine for a data breach is €20m or 4% of global annual revenue. This is due to the GDPR.[0]
[0] https://en.wikipedia.org/wiki/General_Data_Protection_Regula...
[0] https://en.wikipedia.org/wiki/General_Data_Protection_Regula...
Which I think would hit Apple rather hard.