Not disagreeing with your end conclusion, but surely the concept of a limited company exists exactly to have a distinction between legal entities, some of which are not humans but may still violate laws. Take it this way: if the EU fines a company for GDPR violations, it doesn't really fine an individual. Perhaps no individual broke the law explicitly, but as a collective the end result is a law violation.