Edit: had to verify. It seems a bit more reasonable: """Article 83 of the General Data Protection Regulation provides details of the administrative fines. There are two tiers of fines. The first is up to €10 million or 2% of annual global turnover of the previous year, whichever is higher. The second is up to €20 million or 4% of annual turnover of the previous year, whichever is higher.""" - https://www.gdpr.associates/what-is-gdpr/understanding-gdpr-...
Also the GP post, there is more than 'avoiding collecting data'. If you have text field comments form and a 3rd party puts 'personal data' in that, then that is GDPR liable! You also need audit logs and and list of other requirements that needs multi engineer teams to implement properly.
As a result, most small businesses with email are probably not going to be properly compliant on some level and you can prosecute anyone. Just like the new-ish VAT laws, large stores are going to be compliant because they can afford it, while some petty bureaucrat will prosecute the small online shops instead.
(counter-intuitively)