The short story here below started as a submission to the Dutch Information Law Institute’s science fiction contest but quickly grew into much more once I started to create a timeline to solidify the legal situation. The underlying theme is that everyone expects GDPR enforcement to come from government, but that has been haphazard and that’s unlikely to change. Supervisory authorities only have limited capability and would never enforce against everyone. But the GDPR has a little-known clause that says private organizations may enforce on behalf of the people they represent, including (on paper) the ability to demand financial damages.…

This story continues at The Next Web