...they deserve to have their heads on pikes at the front gate.
At some point, the enforcers of GDPR should do this as an example to others. At this point, heavy fines are just a threat. The law might have teeth but the implantation doesn't so where's the motivation for companies to comply? Or two heads on pikes would go a long way to getting others into compliance.