Elizabeth Denham, UK's information commissioner in charge of data protection enforcement, had this to say:

"Having larger fines is useful but I think fundamentally what I'm saying is it's scaremongering to suggest that we're going to be making early examples of organisations that breach the law or that fining a top whack is going to become the norm. Our office will be more lenient on companies that have shown awareness of the GDPR and tried to implement it, when compared to those that haven't made any effort."

Now, whether you trust large bureaucratic institutions to use elastic, broadly defined, excessive powers granted to them wisely, applying self-restraint for the general good, is a function of your general political leaning and life experience more than legal nuance, I suppose.

But you keep just falling back on what they’re trying to do, which matters less than what they’re going to end up doing.

What they’re actually going to end up doing is fail to really curb much abuse, introduce lots of costs and uncertainty, drive businesses out of the EU, worsen the UX of the internet, entrench the largest players who can afford to be mostly compliant and defend themselves legally, and further erode the concepts of national sovereignty and the ideals of the web.

How about this: if EU citizens want more privacy protections than those provided by laws of my country, stop sending HTTP requests to my server in America and asking me to send information back to them. Why the hell is it on me to figure out where those requests are coming from and what bizarre set of laws that person’s country thinks I should have to care about with regard to what I do with the content that their citizen voluntarily sent me?