A few hundred fines in a union of a half a billion people.Right. I'm based in the UK and from my own professional experience dealing with GDPR and ICO,all I can say that companies can and do play pretty wild with data because the reprecussions are simply not there. Nobody is busting your door with fines unless you do outright absurd things+ backlog of cases is so long that by the time someone will start looking into it, you may not even be in the business anymore.