Earlier quoted context omitted.
> fraud then take them to court and make a killing.
I sincerely doubt that much financial reward will come for any random individual doing this to any randomly selected website in that sample that does not meet the GDPR requirements. On one hand, you've technically got the right idea that I ought to put some skin in the game. On the other, it's a reasoning meant to shut down criticism on the same level as the infamous "yet you participate in society, curious!" comic
Then whats the point of GDPR if its not worth taking them to court. Is the idea that only govt can bring them to justice?