Comment by throw_a_grenade

Nothing in GDPR gives you legal basis for that (the penalties under GDPR are paid to the state). But there isn't anything that prevents you to sue them either, so you just need to find another legal basis (like, to prove a damage) and convince the civil court. Civil courts have famously low standard (preponderance of evidence), so it doesn't sound easy, but it doesn't sound hard either.