Furthermore, this is the first fine falling under GDPR. The previous fines handed out by the CNIL were pre-GDRP, with much lower maximum amounts (300 k€). So a 250k€ fine is close to the maximum they could fine, which makes sense given the offense.