Facebook Inc. Tuesday was been slapped with its first fine over the Cambridge Analytica privacy scandal, with reports saying the amount is to the tune of £500,000, or $664,000.

The fine is the maximum amount the UK’s Information Commissioner’s Office can impose, who said Facebook had failed to protect the privacy of its users and see that Cambridge Analytica was misusing its data. European Union rules as of May 24 this year state fines now could be as much as four percent of a company’s yearly global sales, although Facebook can’t be fined that amount retroactively.

“Facebook has failed to provide the kinds of protections they’re required to do under data protection laws,” Information Commissioner Elizabeth Denham said on a press call reported by Bloomberg. She added that the fine sends “a clear signal that I consider this a significant issue, especially when you look at the scale and the impact of this kind of data breach.”

The fine is not etched in stone and could change based on how Facebook responds. In October there will be another update. Erin Egan, Facebook’s chief privacy officer, said in a statement that the company should have done more in 2015 when Facebook first realized data was being misused.

“We have been working closely with the ICO in their investigation of Cambridge Analytica, just as we have with authorities in the U.S. and other countries,” she said. “We’re reviewing the report and will respond to the ICO soon.”

Since March, the ICO said, it has looked through hundreds of terabytes of data from the Cambridge Analytica offices, investigating how the company might have affected the Brexit referendum campaign and the U.S. presidential election.

“Very few people had an awareness of how they can be micro-targeted, persuaded or nudged in a democratic campaign, in an election or a referendum,” said Denham. “Fines and prosecutions punish the bad actors, but my real goal is to effect change and restore trust and confidence in our democratic system.”

Facebook is not the only company being investigated. Cambridge Analytica, or parent company SCL Elections, is expected to be hit with a fine. Political campaigns, numerous data brokers and academic institutions that develop data mining apparatus are also being probed.

Image: shop catalog via Flickr