I'm pretty sure the GDPR is enforced at the national level, by national data protection agencies. The one in the Netherlands is severely understaffed and no match for the lawyers of the likes of Google and Facebook.