It costs money to build protections for customer data now?

Oh I'm sure the service providers took information security very seriously as they proclaimed to. In which case, GDPR is only a legal framework they had no trouble (and serious expenses) to adhere to.