That's been the case for 4 years now, none of these fines have occurred.The largest fines so far have been approaching 9 figures, far more than the "couple of million" in the comment I replied to above.
That's not pocket change even for a multinational and of course there has to be reasonable due process before handing out that kind of penalty. If anything I'd say the fact that several eight-figure penalties have already been handed down is reassuring.
I have the feeling that nobody actually wants to enforce this
I'm genuinely curious about how you formed that impression. Here in the UK our data protection regulators have been fairly consistent in their public views on these issues under multiple Information Commissioners now and have handed down some significant penalties, so I don't really buy the conspiracy theories about corruption and so on.
Worse: in the UK, there's been news about actually weakening the GDPR, based on the Culture Secretary being stupid (or having financial incentives for doing so) and actually believing the tech industry's vilification of the GDPR.
As someone who is both a strong proponent of privacy safeguards and involved in running businesses that actually have to comply with the GDPR, I have very mixed feelings about this.
On one hand I don't like the idea of weakening important privacy protections and I have no faith whatsoever in the competence of the current government here to understand the technical or social implications of these policies.
On the other hand I also don't think much of the GDPR as written. It's full of ambiguity and it is unnecessarily difficult for a good actor to comply with it, particularly smaller organisations that don't have dedicated staff to deal with this kind of admin and also don't have any interest in doing things with personal data that most of us here probably wouldn't like. People like to focus on a tiny number of points that we'd probably agree are positive steps or at least well-intentioned, but the GDPR is roughly a hundred pages long and that's before you include supporting materials like official guidance on interpretation from all the different regulators. There are a lot of small and a few big problems in the rest of those pages once you look past the headlines. Not coincidentally those areas also tend to leave loopholes that some bad actors are relying on to escape the trap.