Have any fines actually been levied and enforced?

Yes, there have been some enforcements already:

[0] https://www.bleepingcomputer.com/news/security/first-gdpr-sa...

The Flirty chat app is fined for leaking 808,000 emails to the tune of 20,000 EUR.

[1] https://news.ycombinator.com/item?id=18531588

The Cuddly chat app is fined for using plaintext password storage to the tune of 20,000 EUR. (No hack known as of yet?)

[2] http://fortune.com/2018/11/27/uber-eu-data-hack-fines/

As foreword, this occurred under older privacy laws and not quite GDPR. Many sources agree that GDPR would increase fine sizes in a repeat event.

Due to a data breach at Uber exposing 57 million people's records, they were fined 600,000 EUR by the Netherlands and 385,000 GBP by the UK.

[3] See nkkollaw's comment below/above.

That's hardly even a speeding ticket for Uber. As long as the fines are this low companies of sufficient size simply treat this as a cost of doing business.

They are this low because they have only started fining companies. If Uber breaks the law again, the fine will be a lot higher.

It appears that the maximum fine is 4% of a corporation's global earnings[1] which could be a lot of money, but still "just a cost of doing business" at the same time.

1: https://en.wikipedia.org/wiki/General_Data_Protection_Regula...

Global turnover. "Earnings" tends to mean profit.

Uber is somewhere around $10b gross revenue, so $400m fine for every breach. Sure it's "just a cost of doing business". It also means that it's better to spend $200m beefing up their security to reduce from 1 data breach every year to one every 5 years.

Marriot revenue is $23b, so that's a potential $920m fine.

IHG (say), who invest in security and don't have a breach, get to charge less for their hotels, or make more profit.

I thought the same thing, but I was corrected here on HN: if you read the same exact like you posted, it says "a fine up to €20 million or up to 4% of the annual worldwide turnover of the preceding financial year in case of an enterprise, whichever is greater", so the they ARE allowed to fine you EUR 20 million.

Much more than "just a cost of doing business" for the majority of companies.

Definitely. Here is an example: https://www.insideprivacy.com/data-privacy/portuguese-hospit.... There are also many, many more examples for smaller companies that get fined 5000-20000.

Fining the company does nothing for the user whose data got leaked. Identity theft isn't a matter of degree; deterring future leakage has zero value. Either there's enough information on the black market to impersonate someone, or there isn't.

So, are you for eliminating prisons?

If I kill somebody, that person isn't there anymore, you don't think deterring other from killing other people isn't reasonable?

I think making it harder to fence stolen goods is a better use of time than increasing the penalties for theft.