> I'm not sure about how efficient the process is, but there is some enforcement.

At least in Germany, it's okay in some states, essentially non-existant in others. I've reported some serious breaches, and about half of the responses were within 5 days, the other half haven't happened yet, after > 12 months. Reminding them just lead to getting an official case number, so they didn't forget, they just can't/won't enforce.

Is there even a single fine about Facebook/Google Analytics/Mixpanel/etc tracking? This is one of the major problems with online privacy right now, should be very easy to detect (run a web crawler and look for the analytics code being loaded) and yet nothing is being done.