That the max fine for GDPR, not the min.

GDPR is really a "fine whatever they want" regime, starting small and increasing for non compliance.

> up to 20,000,000 EUR, or in the case of an undertaking [economic entity], up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher

I think the "whichever is higher" wording does make it a floor but you're right that the "up to" makes it whatever they want. So I guess it's a meaningless variable floor.

It still works out similarly: they could fine a company like Amazon, with a lot of revenue, up to around 21 billion (regardless of profit) while they could only fine a small company up to 20 million.