> So they're saying this is not the case?

Yes it was. The company was fined 20M EUR on standard GDPR-basis and went bankrupt (but unlikely due to the fine alone). Please re-read the above discussion.

The GDPR fine was 608k https://www.edpb.europa.eu/news/national-news/2022/administr...

I stand corrected.

Well, not for public bodies at least: “ Administrative fines cannot be imposed on public organisations, such as the government or state-owned companies, municipalities and parishes” [1]

But luckily this sort of thing never happens in the public sector. Except for when it does: https://yle.fi/a/74-20094950

[1] https://tietosuoja.fi/en/corrective-powers

That's interesting, because if you go here https://www.enforcementtracker.com/ there are a lot of public institutions being hit with fines (if they are enforced it's another issue) - search for Municipality for example

However I don't see any municipality in Finland getting fines

Indeed, but 'the EU' isn't the one enforcing it or leveraging fines - it's up to national bodies/governments and law enforcement.

From that link we can see that the UK fined its own Ministry of Defence 400,000 EUR.

However it appears that Finish public bodies are deemed above reproach by their government.

The law is written such that they could do all that to a small family business that forgot to delete their Apache logs, which isn't good and leaves room for abuse even if they pinkie swear it's only meant for big violations.

Only after informing you, giving you the opportunity to fix things and many many other steps. The harshness is directly related to the size of the company and the companies willingness to fix any issues. They want companies to comply.

Reading the words and interpreting the law in its wider legal context are two different things