Earlier quoted context omitted.
Sure, and they can also chop your hand off or otherwise seriously harm you.
Fuck up something handling PII and the GDPR fines can seriously harm you...
If you simply fuck up during your development, the most you'll get in practice is a letter from the regulator requiring you to change the fucked up thing; Fines arrive when management refuses to change the fucked up thing and tries to invent a loophole instead.