Privacy laws mean nothing without proper enforcement

Parliament's new Digital Privacy Protection Act is, on paper, an impressive piece of legislation. Explicit consent requirements, the right to deletion, fines of up to 6% of global revenue - it reads like a consumer advocate's wish list. But after covering the technology industry for two decades, I have learned to judge these laws not by their text but by their enforcement.

Consider the GDPR, the EU's landmark privacy regulation introduced in 2018. Seven years later, the biggest tech companies continue to collect vast quantities of personal data, often through dark patterns and confusing consent mechanisms. Enforcement has been patchy at best, with fines that represent a fraction of a single quarter's revenue.

What Enforcement Looks Like

Meaningful enforcement requires three things: well-funded regulatory agencies, genuine technical expertise within those agencies, and the political will to pursue the largest and most powerful companies. Without all three, privacy laws become little more than aspirational documents.