This entire issue is sidestepped by having graduated fines (which GDPR has). If they keep doing it the amount keeps going up until eventually they go out of business. It really limits the ability to take advantage of the system which hopefully makes it not worthwhile to bother doing.