Actually one new thing about the GDPR is that consumer rights organisations can sue companies/organisations to enforce privacy rights.

Max Schrems (who's case killed Safe Harbour) has set up an org None of your Business (https://noyb.eu) to do exactly this.