Cyber-attack fines for non GDPR compliance