When GDPR became effective three years ago, companies took notice of the fines and penalties attached to violations of the stringent privacy law—4 percent of global annual sales. The fines have been racking up, including the most recent one by the Irish Data Protection Commission against WhatsApp—$266 million. WhatsApp is owned by Facebook.

The fine follows what the Data Protection Commission says were violations by WhatsApp in the way it provided notice on how it was processing users’ and non-users’ data and how the data was being shared between WhatsApp and other Facebook-owned companies.

WhatsApp stated after the announcement of the fine that it disagrees with it and that it will appeal the decision.