> In practise, enforcement has been focused on punishing poor security, rather than lack of privacy or freedom. That's not true in the slightest. One bank (ING

> In practise, enforcement has been focused on punishing poor security, rather than lack of privacy or freedom. That's not true in the slightest. One bank (ING) in The Netherlands implemented an opt-out for analyzing customers data. Quite a bit of outrage. PR spokeperson said: "all is fine, this is all good, we follow the GDPR". Local privacy authority sent a general letter informing that such behaviour is very likely not according to the GDPR. ING quickly backtracked. Other banks said they'd obviously comply with GDPR. No fine was given.. it was not needed. I don't particularly care if companies are fined. I do care that they take my privacy into account. The latter is what (slowly) is happening.