Fines up to 5 percent of revenue for violating personal data protection regulations: consequences from internal threats