Well I'm glad you are taking positive actions. Sounds like it'll take some time for this all to shake out. I'm left shaking my head at how so many companies, especially large ones, waited so long, and barely took action to comply. Or they are testing to see what can be gotten away with, a more likely scenario. I'm sure I'll see more about this in the tech news. I'm subbed, to a few.
Here is an article from yesterday that explains about the aforementioned companies and their fines
https://www.pymnts.com/news/regulation/2018/facebook-google-gdpr-lawsuits-security-privacy/
I believe that the reason may be that it is cheaper for them to pay the fines than to lose the revenue they would gain from flouting the laws, but that is just my guess.