An administrative fine to a company because of GDPR violations allows the data subject to use the ruling as a basis for damages in a civil case. Further, emotional damages are allowed, also. And CJEU has reaffirmed there's no "minimum threshold" for damages. A user could claim 1 euro of damages. And there's momentum to make class action-esque "collective redress" a reality, which would be a mechanism with all the pros with class action in U.S., but with much less cons. Imagine 400 million users claiming 100 euros in damages. That's some change to spare for the company.