Well that's clearly false. GDPR fines for data breach (when there is enough negliglence) (or even inproper handling of data breach) can be pretty severe. At least in theory, in practice the enforcement depends on the country and the fines are usually nowhere near the legal limit. But there is a penalty.
Money quote, and he's right. In Europe, the GDPR helps stop random data collection, but there is still no penalty for getting hacked and losing customer data. There should be, and in egregious cases upper management should be personally liable for civil suits by affected people.