> Mismanagement of a single users data could cost the farm.

No it couldn't. This is a distortion that has been repeatedly debunked.

Here's a company who had a legal obligation to register with the UK ICO, and they didn't. They were handling medical data. Far from "losing the farm" they didn't even get fined. https://www.bloomberg.com/news/articles/2018-04-26/u-k-healt...

Only increased potential cost. It is absolutely unlikely that the EU will fine huge sums for small transgressions, or even fine at all.

Don't you think it is any bit concerning that they get to pick and choose who gets affected by a GDPR lawsuit?

It is insane. I see the same argument in every thread about GDPR and I just can't wrap my mind around it. I can't imagine how well represented or identified by nation-state politics these people must be that they are willing to concede such degrees of discretionality to a government.

There's a huge cultural difference where people generally assume regulators are going to be fair and even-handed.

FWIW it mostly works out.

Why even have laws then, just let the regulators decide who gets punished for everything.

No. EU regulation uses court as a matter of last resort. This is a good thing. It lowers barriers to entry because the regulators are not the enemy that you need to lawyer up tot talk to.

The more EU critic your website/you/your consumers are the more risk for this potential cost.

They will use this in any way they can. Just because a few say this is not the intent of the law, I have yet to hear a court ruling that minds the intent of the law and not what the law says. (On a EU level that is)

You should speak with people working in banks and handling US persons. Regulation has a cost.