‘All Firms’ Could Face Data Protection Fines