in theory, yes. In practice, good luck getting your complaint acted on. Enforcement of GDPR is a sad joke. To a point that there are law suits and criminal charges[0] against data protection authorities in some countries.

[0] just one example https://noyb.eu/en/irish-dpc-removes-noyb-gdpr-procedure-cri...

>Enforcement of GDPR is a sad joke.

...depends on the country?

yes, and that’s why some countries are far friendlier destinations for HQs of global orgs. But even the more privacy friendly countries are (badly) handling huge backlogs, and are far from efficient in enforcing legislation.

Enforcement of theft laws is a joke, enforcement of mureder laws is a joke.

The solution is not to get rid of the legislation.

I don't think he advocated for getting rid of the legislation? He was just making an observation of the current state of things (which I confirm - GDPR enforcement is basically non-existent).

> Enforcement of GDPR is a sad joke.

There are millions of websites that serve EU customers/users. Enforcing GDPR through the courts is expensive, because courts are expensive.

So GDPR enforcement amounts to making an example of prominent offenders, where the case is cut-and-dried. But before taking enforcement measures, the authorities will notify the offender, in the hope they will come into compliance voluntarily.

Honestly, I think cajoling people into compliance with the law is a better enforcement model than the "drag em into court, then fine the hell out of them" model, when the number of offenders vastly exceeds the legal capacity of the enforcement authorities.

Data protection authorities don’t need to go through the courts. They have the authority to levy fines. They are by and large slow, understaffed, and in some cases allegedly criminally negligent or coerced into inaction. Try to file a GDPR complaint and see where it gets you. I’ve done it a couple of times. Once with the backing and support of NOYB (argueably one of the most prominent privacy organizations), and didn’t get any sense of the system actually working. Yes, there are some prominent fines trying to set example, but as you say with millions of website and thousand upon thousand of violations, this is a drop in the ocean.

> Data protection authorities don’t need to go through the courts. They have the authority to levy fines.

Point taken! But they still have to make a solid legal case, otherwise they'll be appealed and end up looking silly.