https://en.wikipedia.org/wiki/General_Data_Protection_Regula...
This strikes me as hyperbole. Storing passwords in plaintext is a serious security issue, to the point of gross negligence - but the potential harm isn't even in the same ballpark. If your password is compromised and you have poor security practices, you could lose access to online services and perhaps even suffer significant financial loss. If your brakes fail you stand a good chance of death or serious injury.
Car makers might have a bigger responsibility, but the amount of negligence is the same IMO. Many people recycle passwords, so having a company storing yours in plain text has the potential to ruin someone's life.
If you sell 10,000 pieces of 15 dollar items for 20 dollars, your turnover is 200,000 dollars but your profit is 50,000 dollars because the cost of your investment was 1 50,000 dollars.
4% of the turnover would be 8000, which is suddenly 16% of your profits in this case. Oops.
Then you have to take into account that this is your global turnover. Your one branch in Germany made a mistake and suddenly the whole worldwide company has to pay.
Microsofts turnover last year was a 100B roughly. That could end up being a 4 billion dollar fine. 20 million dollars is peanuts compared to what it could be in the worst case. Hundreds of companies could take a 20m fine and not go bankrupt but a 4% global turnover fine will kill almost any company.
In this case, storing passwords in plain text is equivalent to building cars with defective breaks. Definitely something the government should punish.