This is why GDPR fines, say, are a percentage of _revenue_. Harder to mess with without getting into outright fraud.