Your view is of course fully valid, and probably the view reflected in the GDPR legislation. To use your metaphor of chemicals: I see the current situation as

Your view is of course fully valid, and probably the view reflected in the GDPR legislation. To use your metaphor of chemicals: I see the current situation as if the soccer club is handling a 1L container of consumer-grade vinegar weedkiller, and is required to do pretty cumbersome things to document their use and keep it "safe". Many of them have consulted some firm or expert to get boiler-plate documentation, because even if fines are unlikely they are anxious about them. At the same time, we have enormous commercial actors that handle millions of liters of radioactive wastewater in rusty containers. These companies have, for sure, spent a lot of money on "compliance". Some small improvements have surely been made, but the fundamental business practice among these actors of handling radioactive wastewater have not changed. Some "large" fines have been given, but they barley make a dent in the enormous profitability of handling these toxic things. At least not yet, 3 years in. Maybe it will change in the future, and the big actors will fundamentally change their behaviour. If that happens, I can agree that the weedkiller documentation is worth the cost, but so far I'm sceptical. (Since this is an Apple thread, I think its interesting to compare the _real_ privacy gain of GDPR as a whole, vs Apple's simple tracking-popup)