I'm broadly in favour of any consumer protective legislation like the GDPR, but I feel that the GDPR has been misinterpreted by many, in both directions. Those

I'm broadly in favour of any consumer protective legislation like the GDPR, but I feel that the GDPR has been misinterpreted by many, in both directions. Those who ultimately respect user privacy and want to do the right thing are often paralysed by process and making sure that they absolutely can't be sued, rather than being able to show respect for data and best practices but still getting things done. Those who ultimately don't respect user privacy use it as an excuse. They plaster their services with GDPR notices, and then ignore the spirit of the law and sweep up all the data they want, regardless of whether they need it or should have it, but of course this is invisible to users so nothing happens about it. I wonder if this disconnect comes from the enforcement? I'd like to see a few high-profile cases that set out some precedents for what is and what isn't a breach of GDPR.