I really think it comes down to legislation philosophy. In the english speaking countries, cost of compliance is something that is thought about for small businesses, so many regulations are small business exempt until you get to certain employee counts or revenue numbers.

In the EU, that concept doesn't seem to exist and businesses of 1 are assumed to be $100M revenue businesses that can afford to do things like GDPR properly.

Edit: had to verify. It seems a bit more reasonable: """Article 83 of the General Data Protection Regulation provides details of the administrative fines. There are two tiers of fines. The first is up to €10 million or 2% of annual global turnover of the previous year, whichever is higher. The second is up to €20 million or 4% of annual turnover of the previous year, whichever is higher.""" - https://www.gdpr.associates/what-is-gdpr/understanding-gdpr-...

Also the GP post, there is more than 'avoiding collecting data'. If you have text field comments form and a 3rd party puts 'personal data' in that, then that is GDPR liable! You also need audit logs and and list of other requirements that needs multi engineer teams to implement properly.

As a result, most small businesses with email are probably not going to be properly compliant on some level and you can prosecute anyone. Just like the new-ish VAT laws, large stores are going to be compliant because they can afford it, while some petty bureaucrat will prosecute the small online shops instead.

(counter-intuitively)

=max(whatTheJudgeThinks, max(10mEUR, 0.02*turnover))