What about small companies that don’t sell data as a business model?

GDPR punishes the vast majority of businesses that do not have business models reliant on selling user data in favor of trying to catch the ones that do.

Unfortunately, I fear this regulation will do absolutely nothing to stop the bad actors from selling data as they do now.