If it's a US site, I know that's a promise that it can't really make, due to US laws. If it's a EU site, then I could hold them legally responsible if it's just theater.
https://www.enforcementtracker.com/ "... is an overview of fines and penalties which data protection authorities within the EU have imposed under the EU [GDPR]"
If I'm understanding your point, it's more along the lines of: "Lots of people are looking into this sort of thing, and we can aggregate resources about their findings." This makes sense to me, but wasn't what I was intending to critique.
Here's an amusing 320k euro fine https://ico.org.uk/media/action-weve-taken/enforcement-notic...
On 24 July 2018 the MHRA had executed a search warrant at the premises of
Doorstep Dispensaree under the Human Medicines Regulations. In
the course of its search, the MHRA discovered, stored in a rear
courtyard, 47 crates, 2 disposal bags and 1 cardboard box full of
documents containing personal data. MHRA estimated
approximately 500,000 documents but cannot estimate the
number of data subjects.
MHRA have inspected the crates and the information contains:
a. Names
b. Addresses
c. Dates of Birth
d. NHS Numbers
e. Medical Information
f. Prescriptions
The dates on the documents range from January 2016 - June 2018.
The documents were not secure and they were not marked as
confidential waste. Some of the documents were soaking wet,
indicating that they had been stored in this way for some time.
Edit: to be clear, the violation type here seems to have been "Insufficient technical and organisational measures to ensure information security"
The GDPR applies to processing of data of individuals located in the EU/EEU and states the rights of these "data subjects". If your business violates the GDPR and wishes to also operate within the European Economic Area, it could face fines and penalties.