Having used the ICO to try and stop a company illegally collecting biometric information for access to a gym I am not confident it is very effective. Not only d

Having used the ICO to try and stop a company illegally collecting biometric information for access to a gym I am not confident it is very effective. Not only did the gym not stop but the ICO all but rubber-stamped what they were doing. Just like the data protection act before it on a daily basis on the web you see companies openly breaking the law with the wrong defaults and reports just disappear into a pit with the ICO. The law exists but it isn't enforced by the regulator and the way the GDPR law is set up there is no way to bring private prosecutions to enforce fines and get the law applied. So since the regulator isn't doing it the law is effectively useless. Some companies are complying but the bad ones are seeing no consequences and the compliant ones are bound to notice soon that they can safely ignore it completely soon enough. It has no enforcement currently, there is no rush to ensure your company complies.