yes, i agree with both of your statements. :) As far as i understood (correct me if i'm wrong pls) the GDPR fines apply to each single violation and depends on the severity of the violation, so having a big range makes kind of sense, IMHO. I don't know if that applies to this case, though.