GDPR is not enforced enough and it's very hard to get it enforced. Data protection authorities are completely useless at handling complaints from my experience.