User sebow, your account is shadow-banned since 2017. I am unable to reply directly. (HN readers, enable "showdead" in your profile page to see what's going on.)

> in the entire EU there have been _only_ 800, let's say 1k such violations?

No, that's just the tip of the iceberg. Not all violations with fines/punishment are made public, and a vast majority of non-egregious violations will not result in a fine/punishment in the first place because the competent DPA will send a letter outlining what's wrong, how to fix it, and what the consequences will be if it's not fixed.

Those transgressors will simply very quickly come into compliance to avoid the trouble and the affair will not be made public.

There is some enforcement, but the GDPR is widely flouted, most conspicuously with the cookie "consent" banners - they're supposed to give equal choices (to meet the standard of informed consent and not "consent bundling") but they're riddled with dark patterns.

Then there's the Irish who "oversee" Facebook and Google and do SFA.

So the GDPR is not enforced [to a level anywhere near what the legislation is supposed to do].

So, since 2018 in the entire EU there have been _only_ 800, let's say 1k such violations?

Yeah.. GDPR works >assuming< everyone reports every violation of privacy, which is absurd to believe it would be the case.