I encountered this document detailing Datatilsynet (Norwegian GDPR agency) fining Elkjøp (Norway-based + EU-operating retailer) the infringements were found moderate in seriousness ("lower-end of ...