But, unlike the US, in most (all?) of the EU, the most you can sue for damages is the total damages incurred (plus court expenses).
Fines are not always incurred for GDPR infringements. Sometimes you can be asked to delete the data, to block dealing with EU customers, etc...
Sure, and in fact that’s meant to be the primary enforcement mechanism. But fines aren’t what I’m talking about there - civil lawsuits without a regulator involved are possible under the GDPR, although their potential damage is limited to actual damages and the cost of hiring a lawyer.
The first enforcement mechanism is going to be a letter detailing the complaint and asking for information about how you deal with user's data. If they think you are not handling it properly, you are asked to change it, that's it.
What's "damages"? Does "emotional distress" count?
Emotional distress isn’t a thing in the EU in general, and definitely not out of proportion to actual damages. If someone incurred costs as a result of your failure to comply with the GDPR, those would be damages. If, for some reason, they wound up in therapy as a result of your failure to comply and had to pay money/take holidays from work/etc for that, that’d be the closest thing to emotional distress we have.