I looked at that and noticed a quote I feel is salient:

"The GDPR isn't vastly different to the old Data Protection Directive, which has been in force since 1997. The panic over GDPR suggests that a lot of companies had simply been ignoring the DPD. If a bit of bullying is required to get businesses to obey the law, then so be it." (https://news.ycombinator.com/item?id=17149581)

This rings true to me. I do have a strong suspicion, as an American who's worked for an American multi-national at a low level, that people have been ignoring the existing requirements for dealing with EU data properly. For years.

The flip side of all the wailing about heavy handed regulation is that business people will not obey something that isn't enforced. And then feel it is some sort of natural right to go on that way.

Yup, GDPR is pretty much harmonizing data protection laws across the EU. Much of the stuff that's in GDPR had already existed on a national level for quite a while in some EU countries, like France and Germany, but got mostly ignored by multi-nationals.

That's why the EU made these laws a big EU thing, so they are in a better position to actually enforce this stuff on multi-nationals.

> The flip side of all the wailing about heavy handed regulation is that business people will not obey something that isn't enforced. And then feel it is some sort of natural right to go on that way.

Business people aren't special - this is true of all people. Consider the wailing that would occur if police actually enforced speed limits.