for GDPR fines + penalties under other privacy laws