GDPR seems to be on the right track, but I still fear that misuse will not be fined enough; if I remember correctly, it should be 20M or 4% of your gross profit worldwide, whichever is higher, and that'd be a joke to a company like Facebook.
The other problem to consider with GDPR is that it might set a barrier to entry too high for potential competitors to Facebook to emerge, which on the other hand has enough money to comply/pay the fines right away.