> let's wait for the facts first

The fact is political bodies have been empowered with increased enforcement discretion. They are motivated, as political bodies, by politics.

I watched the same thing happen, around 2012, in Frankfurt and Berlin with respect to Germany's regional banks. Weak and undercapitalized, in violation of EU rules, they were summarily ignored due to political necessity. The same tendencies will apply with GDPR. The lack of a requirement for politically-independent enforcement was a mistake.