This is the second-largest fine levied against a single company under new data protection laws the EU imposed in 2018.