I wouldn't be too sure about those GDPR penalties. Dutch universities are also using Proctorio, with the recorded footage being sent to the US: https://www.volkskrant.nl/columns-opinie/opinie-universiteit...
Will take the privacy regulators a few years, justice moves slow. But if I was a Proctorio shareholder I would be very very unhappy if my company got stuck in years of unresolved legal issues with unknown (and high) potential fines.