take legal action against the company or organisation
File an action directly in court against a company/organisation if you believe that it has violated your data protection rights.
That's from the link.
I said, you can be sued for GDPR violations. "Take legal action" = "sue someone".
Also, yes, you can very much sue for emotional damages and real damages due to GDPR violations. The difference between US and EU is that emotional damages in the EU are a few €100 and not a few 1000 or even 10000.
But if you do really leak data (e.g. passwords) and these are then abused for something else, then you are talking about serious costs.
Here you got a link about how the European Court of Justice confirms that emotional damages for GDPR violations is a thing: https://noyb.eu/en/court-justice-confirmed-there-no-threshold-gdpr-damages