They don’t ask them what they want to pay or what they claim the revenue was, they look at the numbers:
Art. 83(5) GDPR, the fine framework can be up to 20 million euros, or in the case of an undertaking, up to 4 % of their total global turnover of the preceding fiscal year, whichever is higher.
They don’t ask them what they want to pay or what they claim the revenue was, they look at the numbers:
https://gdpr-info.eu/issues/fines-penalties/
Although realistically speaking they’re probably just getting fined for one “infringement”, despite committing quite a lot.