Also, yes, you can very much sue for emotional damages and real damages due to GDPR violations. The difference between US and EU is that emotional damages in the EU are a few €100 and not a few 1000 or even 10000.
True. But the thing is, a few £100 doesn't really make up for the filing and legal costs. Particularly when there is a chance you won't be successful.
But if you do really leak data (e.g. passwords) and these are then abused for something else, then you are talking about serious costs.
Again, proving that the specific breach led to the abuse and cost is the issue.
Here you got a link about how the European Court of Justice confirms that emotional damages for GDPR violations is a thing: https://noyb.eu/en/court-justice-confirmed-there-no-threshold-gdpr-damages
There is no limit, but that doesn't mean every claim has a potential for massive damages.
In practice, in the EU, it's just not worth pursuing. Being successful is challenging, and when you are successful in the vast majority of cases the payout just isn't worth it.
Meanwhile, a report to the local DPA or ICO or whatever is free of charge. Literally just sending an email or two. Also, if you did have a claim with any reasonable chance of success, action with the DPA would only strengthen your claim.