While regulators could increase fines for breaching the GDPR, ultimately, it will be the public that makes big tech take notice, says Alison Berryman