Nice! Thank you EU for the GDPR!
For the next step, please let the companies that produce software be held accountable for damages. For Nonprofits change the target to associated companies. Also punish the people responsible, like the developers, for their software and choice of used libraries. If the library was insufficiently supported by the developer, then the developer has no ground to sue for damages themselves.