The problem is that it doesn't seem like the regulation gives the right to a wronged party to sue for those sums of money. You can sue (I guess technically you can sue for anything anyway) but this would involve proving some damages.

The only parties that can enforce the regulation (and levy the promised fines) are privacy regulators (such as the ICO in the UK, or the CNIL in France). Sadly, they've all demonstrated their incompetence and unwillingness to improve multiple times.

There's a non-profit in the UK that wants to take the ICO to court over its incompetence/unwillingness to enforce the regulation - feel free to vote with your wallet: https://action.openrightsgroup.org/help-us-protect-your-data...