FYI, there are no lawsuits with GDPR: You file a complaint with the relevant data protection agency and they then decide whether to pursue this. Should they do that, the company can dispute the claim and only then elgal proceedings would follow (agency v company, no potential award for person filing complaint)