My point is that it should not be discretionary. Either apply the law universally (without taking the viability of the company into account), or lower the fines to a meaningful level.

So you want them to bankrupt small companies while letting large companies getting away with not even a slap on the wrists? That seems strange. The law as written has leeway in the amount to make it more fair than it would be if you applied it universally.

> My point is that it should not be discretionary.

Right. But that won't work.

We set the fines at say, 20% of the business.

So a 'mom and pop' firm breaks it, gets reported. Ok, now they're out say, 20,000 EUR (scale to whatever is appropriate in your country for a small company).

Then a big business breaks it for maybe, gets reported. Ok, now they're out $35.57bn.

These might indeed be acceptable amounts. Now imagine that for example, instead of having a fair number of people affected, it is just two people. Or three people. And perhaps in this instance the people involved were only marginally affected by it, perhaps at worst they would have lost a couple of hundred $currency.

Technically speaking, the companies still broke the law, but suddenly perhaps the punishment does not quite fit the crime!

That's not how the law operates in basically any jurisdiction. If we allow discretion in punishment for things like murder, why not this? If you think discretion should be removed from all law then that could be a sensible argument, but it's a tough one to make and the GDPR is probably not the place to start with it.

So if Amazon were caught doing this they should be fined €20k too?

One would assume the same care would be taken not to drive Amazon out of business, but considering the difference in size of the two businesses, the fine would most likely be much larger.

Except that fundamentally biases the law towards a certain size of business.

Universally large fines would threaten small businesses while reasonably charging large businesses. Universally small fines would potentially be reasonable for small businesses, but would be negligible for large businesses.

Why shouldn't it be tailored to the company's size/viability?

There is discretion in the application of almost all laws. The law is not computer code, it must be interpreted and applied.