GDPR penalties DO deter bad actors. It's so effective that many American companies without a European presence at all take actions