Still it’s much more serious than this and they have several other batches. It’s unacceptable that no one is held to account for these breaches.
What do you expect “them” to do? The idea is that you have this law to proactively monitor and hold the companies accountable, making them have systems that allow a private citizen to be aware of, gain access to, and have the right to require a company to eliminate any personal data.
You can’t just say go after the companies that have a breach. That is very reactive. GDPR is meant to be a proactive measure to ensure that companies take responsibility for the data they have, and emphasize that the data they have is it their property.
The fundamental change here is opt in vs opt out. In order to not be breaking the law, you have to get explicit (active) permission to collect the data in the first place, rather that implicit (passive) permission. You also have to have a system in place to allow access to that data upon request, and are legally require to comply with any directive to remove/eliminate/delete any and all personal data from the owner of that data (i.e. the private citizen).
The interesting thing about this is that if a company is in compliance with the law, it will be extremely hard to hold them accountable should a breach occur, as now in theory, all the personal data they have has been actively given, and information about how data is stored, secured and used is freely available to those who allowed their data to be collected. It could be argued that in practice, GDPR is more of a corporate CYA measure than a statement of intent in defense of personal privacy.
People aren’t willing to give up using their favored services & websites, and essentially are very ready to sacrifice privacy for convenience.
Arguably the only real practical effect of GDPR is that it is much more irritating to browse the web these days in the EU, with auto pop ups about allowing cookies and a “personalized browsing experience.” That a 3 decade old internet business model is still relatively unchanged is our fault as consumers. But at this point “free” cloud services are so embedded in the marketplace that websites and companies are actually requiring opting in as a condition of using their website/service - i.e., we’re going to collect your data whether you like it or not, so unless you allow this, you can’t go further. When confronted with this ultimatum, most consumers just comply rather than take the time to try to find an alternative or do without.
