When Google was fined 10 million euros (then-U.S. $10.6 million) by Spain’s data protection authority (DPA) last month, it reignited interest about why the company behind the world’s most popular internet search engine—and other Big Tech firms, generally—have not been more frequently penalized under the General Data Protection Regulation (GDPR).

Neil Hodge is a freelance business journalist and photographer based in Nottingham, United Kingdom. He writes on insurance and risk management, corporate governance, internal audit, compliance, and legal...