Over the almost five years since it was enacted, the General Data Protection Regulation (GDPR) has drastically changed the privacy landscape. But for some, the GDPR still does not go far enough, despite the number—and size—of fines levied in recent years.