I'm afraid you are correct, but hasn't the whole system collapsed if:
- Is this good for our businesses?
is is part of your consideration when you are trying to find out if something is illegal or not?
Literally who cares? Let them deal with it. It doesn't matter how much money they lose. They should have considered the consequences of abusing people's trust and violating their privacy under questionable consent.
Corporations are vastly more powerful compared to individuals. Courts obviously need to favor the latter in the vast majority of cases. To do otherwise is injustice.
"doesn't matter how much money they lose" -- of course it does, these companies employ people and generate lots of government revenue (even if they skirt corporate taxes).
There are political and economic concerns, not judicial. The fact the company is important does nothing to remedy the fact that it exfiltrated private information to foreign intelligence agencies.
Example; how one individual singlehandedy forced the hands of Spotify to reverse an API decision they made blocking the export of your playlists. Note how Spotify thinks their TOS supersedes the GDPR. It does not. Otherwise, we would have corporations directly creating laws.
For example the UK's enforcement arm, the ICO, recently found that the adtech industry was in violation of the GDPR, then did nothing:
https://www.openrightsgroup.org/blog/the-ico-must-fix-the-ad...
As far as I know, I can't personally sue these companies for this, and if the ICO does nothing then what's the law is meaningless.
The follow up from the Open Rights Group is here:
https://www.openrightsgroup.org/blog/parliament-must-hold-th...
If you care about privacy in the UK, please donate to ORG, I started a direct debit years ago and have always been impressed with their work and focus:
Couldn't you sue ICO then?
https://action.openrightsgroup.org/help-us-protect-your-data...