You are correct. The fines for GDPR violations are severe and they inforce them too. They don't care if they put a company under. That's the whole point of them getting strict with inforcement. Nobody was complying so they started getting mean.