The extortion opportunities are looking very sweet. Breach a company and charge them a keep quiet fee. Lets call it a consulting fee. If its cheaper than a GDPR fine the company will likely do it.
Not saying that we should adopt such a system, potentially terrible idea but it amusingly is better than other "do something" legislation in that it would actually help the target problem even if there are clear downsides.