Max Schrems, privacy activist and founder of the non-profit organization NOYB, filed a landmark complaint against Facebook Ireland on 25 May 2018, the same day that the General Data Protection Regulation (GDPR) came into effect. Schrems argued that Facebook was not sufficiently protecting users’ data in compliance with the GDPR, a sentiment echoed by numerous stakeholders who spotlighted the regulation's ensuing compliance mechanisms.

On 22 July 2020, Ireland's Data Protection Commission issued a €450 million fine (approximately $530 million) against WhatsApp for lack of transparency in its data processing practices. This fine, while significant, serves as a case in point about how GDPR enforcement has often morphed into what can be described as 'compliance theater'—a performance where companies are penalized but the systemic issues remain largely unaddressed.

Companies across Europe have invested in extensive compliance frameworks, often turning the regulations into mere checkbox exercises rather than genuine protection. For instance, a report published by the European Commission in December 2021 revealed that 90% of companies believed they had a GDPR-compliant data protection policy in place; however, only 29% of them were confident in their actual practices. This disparity suggests that the primacy of legal compliance often overshadows actual user privacy safeguards.

The revolving door between regulatory agencies and private industry becomes evident here as well. For example, Inge Engström, who served as Deputy Director-General at the European Commission until 30 November 2020, transitioned to a leadership role at a major compliance consulting firm on 1 December 2020. This movement raises pertinent questions about conflicts of interest—who truly benefits when those who shape policy drift into lucrative advisory roles for compliance frameworks?

Billions have been spent by corporations on GDPR compliance solutions—from AI assessments to legal consulting—who are these contracts benefiting? Notably, Accenture, fresh from its €1 million ($1.2 million) consulting contract renewal with the European Parliament on 15 March 2021, has positioned itself as a leader in GDPR advisory, profiting from the very regulations that are ostensibly designed to protect data subjects.

The cyclical nature of enforcement and compliance measures becomes painfully evident: three high-profile GDPR breaches result in fines, leading to increased budgets for compliance consultancy, yet actual user privacy remains compromised. Since 2018, despite the influx of fines totaling hundreds of millions, the core issues surrounding user data protection have seen little substantive development. Privacy theater persists as both corporations and regulators engage in performative accountability.

To understand the larger context, we can trace the roots of this compliance cycle back to earlier legislative frameworks, including the 1995 Data Protection Directive and even earlier privacy initiatives dating back to Cold War surveillance concerns. These structures have evolved but never truly dissolved, creating an environment ripe for performative compliance strategies where the semblance of privacy overshadows true protection.

Notably, compliance is often supported by a quiet infrastructure of advisory councils and task forces with deep ties to the corporate world. For instance, the European Data Protection Board often includes members with direct affiliations to major tech firms which raises questions about the neutrality of regulatory enforcement—a point echoed by many critics of GDPR’s implementation.

The Susurluk principle remains applicable: who profits from the compliance framework? In effect, thousands of firms that offer advisory services capitalize on the fear of non-compliance, yet this forces companies into a cycle of spending rather than focusing on enhancing actual user data protection.

This situation presents a clear pattern: this is the third major wave of privacy regulations since the introduction of the 1995 Data Protection Directive, yet as evidenced by the growing frustration among users regarding privacy protection, genuine data security remains an elusive goal, overshadowed by a comprehensive compliance structure.

In summary, while GDPR and similar laws are intended to enhance personal data privacy, they have instead created elaborate compliance rituals that often prioritize form over substance. Thus, the fundamental essence of privacy remains obscured by an incessant focus on regulatory compliance rather than meaningful protection.

For those seeking a smarter, task-based solution to privacy and data processing, consider Virgil, the AI agent that operates per task, available through installation with npx virgil-cli — no monthly subscription or weekly usage cap.