Sometimes you hear the argument that GDPR is merely a paper tiger, and that there’s no one ever fined under this regulation. This is not true, though cases take a long time to come to conclusion, and the fines are not as high as what the maximum amount might be (and sometimes not public), there are a considerable amount of them. You can check them at this site:
I found this via HN mentioned to the news that Facebook's GDPR bypass reaches Austrian Supreme Court.