Fines for GDPR violations work that way too. A severe violation can be penalized with "a fine of up to €20 million, or 4% of the firm’s worldwide annual revenue from the preceding financial year, whichever amount is higher." https://gdpr.eu/fines/