But as a general principle, you sue for actual damages here in England, and thus you would normally need to demonstrate the real harm that has been done in orde

But as a general principle, you sue for actual damages here in England, and thus you would normally need to demonstrate the real harm that has been done in order to be awarded compensation accordingly. We also tend to have a loser-pays default when it comes to costs. So unless this all goes south and winds up being like our infamous defamation laws (see "libel tourism") it seems unlikely that the GDPR will create a lucrative hunting ground for ambulance-chasing lawyer types. After all, if you were being sensible about privacy and security anyway, one would hope that actual damage to anyone whose personal data you held would be little if anything, even if you're in breach of the technicalities and paperwork requirements under the GDPR. The big punitive fines people are talking about are the ones available to the regulators via a separate mechanism. As far as I can see, they do potentially apply to technical breaches as well, but that's quite a different context legally speaking.