I feel like the EU should have made it so that you could actually sue corporations for GDRP violations (as long as you have enough evidence for a court to hear the case) and for the accuser to get part of the fine if you win. Would have been a much more effective enforcement strategy.