What is the point of the GDPR if it is not enforced?
It is enforced.
These fines are typically small at first, and rise exponentially as the firms do not comply.
It's not like you just complain and the next day the business in violation starts behaving.
It helps so far that I (as a user) see upfront how much an article costs (in tracking data). I can then decide if I want to pay for it or not.
https://www.dlapiper.com/en/uk/news/2019/02/dla-piper-gdpr-d...
It is rather disingenuous to upsell ICO as a vanguard, instead of describing it as a toothless quango, at best.
I am curious if someone can argue for the point that only the medical data from you doctor should be protected and the rest can be sold behind your back.
The very concept that this is 'your' data is in error. It is demographic data collected by third parties 'about' you. You've entered into consensual relationships to provide all of this data with those third parties, for the express purpose of using it for advertising. There is no expectation that it then would not be used for that purpose, quite the opposite thats why it is collected.
Conversely, your relationship with the data your doctor collects has had a long expectation of privacy. Reinforcing that expectation with explicit laws doesn't change the basic relationship.
Before GDPR all of this was not so clear for many people, my parents do not know that they are giving up their data, that it is sold on a market, that a profile of them is created somewhere and each click will put some new tags on that profile.
I agree that this is a big one, and I believe that businesses indeed should explicitly and plainly let users know what kind of data is stored and how it is used.
However, isn't one of the main issues with GDPR the fact that it doesn't give users an option to enter in this kind of relationship with a company, even if both parties are aware and consenting?
I am not a legal expert, but I thought(according to my understanding of GDPR) that businesses are not allowed to store personal data about users, period, unless the data is needed to provide the service. I have no idea if "we need this data, so we can use it for ads to earn the revenue needed to finance our service" qualifies as "needed to provide the service", but I always thought it didn't. I will be happy if someone could clarify this point and, potentially, prove me wrong.
It's the same with taxes. If you're a small company, you're paying the official rate. If you're Google, you'll have a Double Irish with a Dutch Sandwich, who cares if you need to pay €10m to set it up and get the okay from revenue services (there's a fun report on how the uppermost German tax officials "freelance" for the large tax consultancies on the side and make a lot of money to write "articles") - you'll save billions.