It is a crime and the state fines the company for breaching the law.
You need to compensate these people... at least a little bit.
And given that basically all bigger German companies have a works council [1], this is really really likely to happen.
If there were punitive damages awarded to the victims, a lot more illegal behaviour would be properly prosecuted. Officials like the state data protection officer are intentionally understaffed, so they only prosecute the most egregious problems. Private citizens and their attorneys could take up the slack if it were financially viable.
I can assure that this is not an issue for Germany. If anything they are overstaffed based on the false and egregious bullshit I have had to pay lawyers to get overturned.
The solution to weak law enforcement is to give more power to the law enforcement, not to a selected class of privileged people.
Then you have to balance it out with harsh punishments for unsubtantiated lawsuits but that could sometimes affect legit victims that were just short of evidence. It's better to not have the problem in the first place.
It would be better to just burn the money then to give it to the victims.
Victim separately could prove what actual harm was done and request support, but this should be completely separate process ideally financed separately, that disregards how rich is the perpetrator or how severele he violeted the law.
Same way money from fines shouldn't land anywhere near the cops that give the fines because this creates perverse incentive.
1. https://en.wikipedia.org/wiki/Talk:Civil_forfeiture_in_the_U...
The only thing where there is a really obvious wrong incentive are parking violations, those go to the community, the community prosecutes and sets the local parking regs. So that, along with speeding tickets inside city limits (in parts), is a money-printing business for them.
If fines were distributed to the public and the ICO collected zero income, I believe the political will do finance it would disappear. I was not suggesting officers themselves would change priorities based on individual pay outs, sorry for the confusion.