The most important critique of GDPR is actually that its not enforced more often/strictly and that the maximum damages are _still_ too low to make many companies actually care.