It won't happen in Australia though, as we are governed by fools who barely understand technology, and if they need to, rely on the representations of business to make any decisions.
Where is the real benefit to Europeans' privacy?
We've already seen quicker reporting of breaches. Web trackers are down [0]. Telemetry without an off-switch has been ruled in violation (Microsoft Office [1]). In smaller cases, apps that don't secure passwords properly have been fined [4]. I'm sorry for linking to el Reg so much, but there just aren't that many English language news outlets covering these things.
As for "forcing me to consent", it violates the GDPR (e.g. [2], ICO "consent cannot be freely given and is invalid"). This is largely websites trying to see how far they can push it, because the data protection agencies aren't handing out fines straight away. This is actually very frustrating in obvious cases.
If you'd like to help getting rid of them, but aren't a European or can't be bothered reporting them to the relevant data protection agency, Max Schrems has founded https://noyb.eu/. Privacy international has also done some work in this area [3], but Schrems seems to be focussed on the "smaller" violation such as popups, and has a great track record.
[0] https://www.theregister.co.uk/2018/10/12/gdpr_helps_google/
[1] https://www.theregister.co.uk/2018/11/16/microsoft_gdpr/
[2] https://www.theregister.co.uk/2018/11/19/ico_washington_post...
[3] https://privacyinternational.org/topics/general-data-protect...
[4] https://www.theregister.co.uk/2018/11/23/knuddels_fined_for_...
When I watch my non-technical friends use websites, they dismiss the prompts without reading or understanding them.
That's a problem in general in IT. The nice solution would be websites respecting DNT option in browsers and every browser asking if they want to be tracked on the web or not. Or well, we could just purge 3rd party cookies from existence for starters.
Before we created the relevant laws, economics also drove companies to hire children, dump trash into rivers, ignore safety, etc. It wouldn't be too much of a stretch to say tracking cookies and advertising malware are the pollution of the internet.
Even as a tech person, I'm skeptical ad-based services are a net win for consumers. It wouldn't be the end of the world, IMO, if tracking cookies and shady marketing practices were illegal and companies had to use traditional sales tactics online.
Every single one responded positively, or at least semi-positively. It's good to remember that there's requirement to accept GDPR requests delivered in any form. So for example infobel had a non-working contact form, and no e-mail contact on the website. So I just sent an e-mail to info@infobel.com and they had to respond, even if it looks like from their website you have to use website conctact/removal request form. The same goes for Facebook messages, or twitter DMs if the company has these communication channels.
Benefit for me is; knowledge is power. When I know a website is intent on ravaging me, I can just keep moving.
Well, if that was viable, we probably wouldn't have needed such high fines in the GDPR. Two scenarios:
A) It's hard to move away because of dominance, e.g. Google. You either have to buy an offensively expensive iPhone, or root an Android phone. Even then living without the Play store is hard. Moving e.g. email providers takes years nowadays regardless of the provider. Google Search and Maps can be replaced in theory, but it's quite a chore - Google didn't get big on bad products.
B) What spending? How do you stop spending on something you aren't paying for with money? Yes, ad and tracking blockers, but for Joe Bloggs that isn't obvious. And Consumers weren't paying Equifax directly, otherwise they probably would have been bankrupted.
> Has GDPR meaningfully changed enforcement of rights?
We don't know yet. (I'm assuming this isn't a rhetorical question.)
On the one hand, the fines now have business impact. For example, before the GDPR, the UK's ICO could only hand out a laughable max fine of £500,000. On the other hand, ICO has been toothless, only handing out the max fine once. ICO was severely underfunded, so this is almost by design.
Germany is pretty privacy conscious, but unfortunately data protection is also handled on a state level. So there are 16 data protection agencies and one federal one (Datenschutzaufsichtsbehörden, the federal one being the BfDI). From experience, that kind of bureaucracy doesn't help with speed.
While this isn't enforcement, it has had some meaningful effect. Having worked for a big multinational, there was a lot of money and hours spent on GDPR compliance. This reduces e.g. data retention, which could help limit damage in future. Before that, data retention was basically endless.
We've seen some minor cases, but being a lawyer, I'm sure you know we're at least a few years off the really big cases, especially if the European data protection authorities need to work together.
As for the compliance effort: it’s mostly security theater in the enterprise, and benefits consultants and lawyers mainly. I take your point about retention, though.
We’ll see if any of it really makes any difference. I’m pretty jaded after doing this since the late 90’s.
This is an argument heard all around the world with regards to similar issues. I wonder to what extent it actually applies, and it is not your latter statement - that lobbying and commercial interests are at play - that is prevailing (so they are 'willing fools').
Hard to know, of course, but I'd say these lawmakers need not have to know the intricacies of the technology themselves, but can rely on accurate reports detailing their implications in layman's terms. They can have expert advisory groups do the hard work for them.