> That's not entirely true, for example SEC enforcement is usually a civil action
You are correct, I spoke too broadly.
Ironically, when discussing GDPR's regulatory structure, American securities law is my analogy. It's a high-cost structure. It deters new entrants and encourages bureaucracy. The cost is worth it, with securities, because the risks are so great.
GDPR is one way to do privacy regulation. From my American perspective, it's the wrong way because it implicitly trusts the government to act justly. But its results shouldn't detract from other fights to install reasonable privacy regulations.
That's not entirely true, for example SEC enforcement is usually a civil action.