This is welcome, but moves like this will only make a difference if the legislation has teeth — will there be some ombudsman that I can appeal to, who will inve

This is welcome, but moves like this will only make a difference if the legislation has teeth — will there be some ombudsman that I can appeal to, who will investigate that a firm is using encryption (correctly), and issue a hefty fine for breaches? Or will it turn out like the cookie legislation: potentially good in theory — that you should have an opt out to non-essential tracking cookies — but because of vague hand-waving around implicit opt-ins and not forcing firms to distinguish between essential & non-essential cookies, means the only outcome is an annoying banner on every website and no real effect on end-user privacy.