Does the history of data breaches and fines point to a tough future under the new EU data protection rules?