GDPR works, but only where someone enforces it