[ryanlol]

>Can GDPR be used as an audit mechanism for breached passport numbers? And if so, what would that process look like?

I'm not quite sure what you mean, but the answer is probably no.

>Can hotels be fined if they’re found to not be GDPR compliant?

Sure, but is anyone GDPR compliant yet? I'd imagine that all the DPAs in EU are extremely busy right now.