Regulators and civil society groups have taken the GDPR's predecessor (the Data Protection Directive) to court plenty of times, usually very successfully. The

Regulators and civil society groups have taken the GDPR's predecessor (the Data Protection Directive) to court plenty of times, usually very successfully. The most famous regulator-brought court case is probably the Google Spain/Costeja "right to be forgotten" ruling of the Court of Justice of the EU (CJEU). 59 more CJEU Data Protection Directive cases here: http://curia.europa.eu/juris/liste.jsf?pro=&nat=or&oqp=&dates=&lg=&language=en&jur=C%2CT%2CF&cit=L%252CC%252CCJ%252CR%252C2008E%252C%252C1995%252C46%252C%252C%252C%252C%252C%252C%252Ctrue%252Cfalse%252Cfalse&td=%3BALL&pcs=Oor&avg=&page=1&mat=or&jge=&for=&cid=219082 http://curia.europa.eu/juris/liste.jsf?pro=&nat=or&oqp=&date...