Actually one new thing about the GDPR is that consumer rights organisations can sue companies/organisations to enforce privacy rights. Max Schrems (who's case

Actually one new thing about the GDPR is that consumer rights organisations can sue companies/organisations to enforce privacy rights. Max Schrems (who's case killed Safe Harbour) has set up an org None of your Business (https://noyb.eu https://noyb.eu) to do exactly this.