I can't find any sources now, but there have been numerous fines for minor data breaches. (Like sending a mail to all your clients and putting everybody on CC, not BCC, so each client gets to know all others).

But they absolutely haven't been fined to bancrupcy, just a few thousand Euro.

That's why I underscored the "up to".