Yes and No.

Yes in that people already have that agency to sue. I'm sure you've heard of a class action lawsuits.

No in that I don't approve of the GDPR prescribing what constitutes a privacy violation rather than leaving such deliberations to contracts and courts.

The law prescribes what constitutes an IP violation. Contracts and courts didnt invent the concept of copyright. You benefit from the privilidge granted to you by law.

While I'll grant you that copyright is a privilege granted by government, copyright is not the only form of IP protection and not all of them are treated in the same way. I will also add that what constitutes an IP violation is determined by the particular claims of the rights-holder with respect to the wording of license/contract in question. Those violations are not predetermined "defaults" set up by legislation.

The GDPR, on the other hand, presupposes a global positive right to privacy irrespective of national sovereignty or contractual agreement to the contrary and that any alleged violation from any point on the planet carries with it a presumption of guilt. A regular complaint on this forum is that the US regularly oversteps it's bounds via legislation like the CLOUD ACT. I don't see why it's any less of a concern when the EU does it.