I think the statement is accurate with regards to the "bark or bite" criticism of current EU privacy law. Enforcement of these laws lacks the efforts expended o

I think the statement is accurate with regards to the "bark or bite" criticism of current EU privacy law. Enforcement of these laws lacks the efforts expended on, for example, antitrust enforcement. Among the problems is that Europe doesn't have "class action" lawsuits. Coupled with the fact that any single individual usually incurs only relatively small harm from privacy violations, the incentives to invest in lawsuits just aren't there. Public enforcement is also delegated to privacy watchdogs in each member state. Because jurisdiction is based on a company's registration, there is an obvious conflict of interest in these positions. This has played out, for example, in numerous cases against Facebook: It is (like Google and others) registered in Ireland, where the government has long been rather sympathetic to industry interests. The US Constitution says absolutely nothing about privacy, but the Supreme Court has found it reading between the lines of the 4th (unreasonable search and seizure), as well as the 1st. There's also the 9th ("This list of rights is not intended to be exhaustive" or something to that effect). In practice, US data protection lacks the EU by a wide margin, except for certain, specific cases such as video surveillance (which the UK uses far more) and health data (HIIPA seems to work rather well).