[sunsetonsaturn]

The GDPR is meant to address this problem, check out https://www.enforcementtracker.com/ to see what the most recent rulings are.

Your observations are correct, the regulation is able to deal with the damage after it was done, and apply some form of punishment after the fact. It takes whistleblowers and activists to reveal some of the wrongdoings, otherwise the violations remain unknown to us.

Therefore there has to be a greater push towards proactive measures - letting people vote with their wallet by making informed choices; the prerequisite for that is for the relevant information to be available to them.

Have a look at some of the research I've been involved in, we're trying to solve this exact problem: http://privacy-facts.eu/