There are so many people undergoing GDPR workplace training at the moment that I think people may stop and think

So many people or so many people in the web service tech industry that frequents HN?

To give you an idea, I work at a school. Every member of teaching staff all of admin, site-services and IT have had GDPR training. Getting consent for photos, for school trips, referral to outside agencies is a substantial issue, as is leaving student records on desks, keeping files with PII on encrypted sticks etc.

This is a school.

That's interesting. So now a student can come back and demand you delete their permission slip for a field trip?

Schools collect data under several of the possible lawful bases

https://ico.org.uk/for-organisations/guide-to-the-general-da...

In the case of a permission slip - the school already holds lots of info that the school collects under the 'Public Task or 'Legal Obligation' bases.

The slip then contains additional information that is only collect because the kid is going on a trip, but is necessary for the trip. This would be collected under the Contract basis 'If you want to go on this trip, the following info is necessary'.

If the school also wants to take photos of the child on the trip, for example, then the parent will be asked for consent.

So to answer your question, the parent (assuming the child is under 16) could ask for:

1. The photo consent to be removed - in which case the trip must continue

2. The info pertaining to the school trip to be removed (in which case the kid would no longer be going on the trip)

But they cannot request the core data that the school holds to be removed, unless they take their kid to another school.

Any company that stores any kind of personal data on private citizens. Which means the vast majority of companies.

I work at a telco/ISP and GDPR training (and graded tests) is mandatory for everyone, from customer support to CEO.

The click-through is itself likely violating the regulation. All it takes is for someone to complain; it's not enough for 99% of people to click through.

How long would it take a EU court to notice, plan, and take action ? VW was blatantly lying about emissions for years and nobody seemed to care

EU courts take notice when someone files a complaint. In the past, great people like Max Schrems have taken the mantle. I'd certainly support him or anyone else planning to follow up on his work.

https://en.wikipedia.org/wiki/Max_Schrems

I think the current population that wants GDPR privacy stance is small but feared to be influential by Facebook.

It also coincides with FB's recent privacy breach news and overall general public dissatisfaction with FB's policies.

I know a lot of folks who simply don't use FB and are realizing that it's "really not free" in liability terms.

So does this turn into a groundswell? Probably not, I agree with you. However, it does put some fences up that is probably causing FB to feel a bit more nervous. GDPR may be the first of many such efforts...

I think most will just click through. I know I will. However there is probably a larger percentage of Europeans who won't compared to Americans.

In reality, caring so much about their privacy seems to be a German/Nordic thing. There was no public outcry that led to GDPR , it seems to have popped up more through bureaucracy rather than popular demand. I think most europeans are just as oblivious/indifferent to privacy issues as americans, and we don't even have the CA scandal here. So yes, 99% will just press accept and forget about it. It's mainly the vocal proponents that you hear.

In business circles there appears to be widespread panic about GDPR.

Amongst "ordinary" people, there is a growing sense of unease about data collection - reflected in the "Facebook must be listening to my phone because they overheard a conversation I was having and now I'm seeing ads for it".

I believe people are starting to understand the implications of data collection and are quite unhappy about it.

At least for some, it's the result of experiences with and/or knowledge about Stalinism, the Nazis, et al. For those, it doesn't matter what 99% of the people do, we don't derive the value of something from how many people do or think it, we derive the value of people from what they think and do in relations to these questions. It's fine to be "not well traveled", but I wouldn't put my hand into machinery I don't 100% understand. That you don't see what is the lioness and what are the cubs is not relevant to the lioness.