You forgot about the best part, in terms of the “GDPR threat” effectiveness:

Fines can be up to €20 million or 4% of global revenues…, _whichever is greater._