But also kinda weird. There seems to be a lot of fines for hospitals for example.

Some Portuguese hospital was fined €400,000 for ‘Insufficient technical and organisational measures to ensure information security’