So, since 2018 in the entire EU there have been _only_ 800, let's say 1k such violations?

Yeah.. GDPR works >assuming< everyone reports every violation of privacy, which is absurd to believe it would be the case.