I'm not an expert on GDPR but if PII is being collected and distributed/sold without explicit consent that sounds like it should be a legal liability. What is the per-violation fine for things like this under the GDPR?
There is also no guarantee of any fine, see vertex-four's comment. For something like this I expect they will simply be warned to fix their WiFi and won't actually be fined unless they continue being in violation.