“The €9.55m fine is one of the largest relating to GDPR to date and comes after … the company had failed to enforce Article 32 … which requires businesses to take appropriate technical and organizational measures to protect the processing of personal data.”