That's not how it works. I think you are mixing up damages to be awarded by courts to an individual data subject (right to compensation, Article 82) with penalt

That's not how it works. I think you are mixing up damages to be awarded by courts to an individual data subject (right to compensation, Article 82) with penalties (Article 83-84) - the latter having a special meaning, in practice covering the administrative fines by authorities (DPAs). There was a case by the ECJ (C 300/21) saying that for damages to be awarded to the individual, they have to prove the material or non-material damages involved. Regardless, any data protection authority can and do fine companies for breaches such as this one and also for late filing, and while DPAs also have to take into account the damages caused to data subjects when deciding the amount of fine, that's not a standard that has to be proven for each data subject separately and is therefore not as strict as the right to compensation. FlightAware definitely should be fined... Like Booking, NTT or Twitter or banks for breach obligations, for more than €400k. But it's still strange that very few US companies were fined so far in relation to no or late breach notifications - not that they were not fined heavily for failure to comply with other obligations. https://www.enforcementtracker.com/ https://www.enforcementtracker.com/