What about the 4% of the global turnover of a company as mentioned in https://gdpr-info.eu/issues/fines-penalties/?

If it were effective, we wouldn't all endure daily GDPR violations. But we do.

Non-enforcement is a different issue to fines being too low.

They're related, though. A portion of fines fund enforcement activity. (IMHO, a higher portion should go to enforcement. Right now way too much goes into general funds.)

> fines are no longer consequential

I don't see how this can possibly be true. Any corp has finite money, and operating costs; If the fines are high enough, they will be consequential.

> to span multiple countries

you can't really evade US fines/sanction and continue to operate in the west.

No government is going to fine Amazon or Google enough to break the company. It would displace thousands of workers, and have a serious impact on the local economy where those companies are based, if not the whole country. If the fine is large enough to have a material impact, it's the rank and file who are laid off as the company restructures, and the company then uses tricks like tax offsets to pull through from a loss of profit. This is before considering political ramifications, e.g. it's in the US' best interests to have the largest tech companies, and clipping their wings too much would cede ground to foreign competitors.

At the end of the day, the C-suite either know that the law is being broken, or they don't. One makes them responsible, and the other makes them criminally negligent. I absolutely believe that C-suite executives of VW, for example, should have been thrown in jail for diesel-gate. Not knowing the law is not an excuse for breaking it. Similarly, if you're presiding over a company, and your company is breaking the law, plausible deniability shouldn't be a defense. If you're getting paid to run the company, you are responsible.