In countries like that I would expect the result to:
1) not involve a civil suit whatsoever - instead of filing a class action claim resulting in a settlement or penalty assigned by a court, the people would complain to the relevant regulator, who'd investigate, impose fines and mandate changes in company processes.
2) in a scenario like this - where none of the complaintants assert any specific direct loss but simply generic increased future risk - there would be no payments to the affected individuals at all, any fines would go to the government; the main goal will be to enforce future compliance with the rules, and punish past incompliance with fines to deter other violators. Individuals can demand and get compensation that will cover specific actual damages that can be demonstrated, but no more, and nothing unless/until any consequences materialize. The "You wronged me, I'll sue you for $$$$ despite not being actually $$$$ out of pocket right now" style of civil claims (that seems to be common in USA, at least in mass media) is rare, and when it happens, it's usually unsuccessful.