Assuming they have EU resident data subjects in there, have they notified a European regulator? If not, this would be a case for a fine big enough to discourage others from not doing so.
Assuming they have EU resident data subjects in there, have they notified a European regulator? If not, this would be a case for a fine big enough to discourage others from not doing so.