I was with you until you mentioned "GDPR" right after "effective enforcement". GDPR is, if anything, a great example of ineffective enforcement.