This would require someone willing to enforce the GDPR. So far the various data protection agencies have been very lazy.