One can hope that the store operators will also be heavily fined for their apparent failure to protect their customers' information from infosec threats. Show them teeth, GDPR.