Retards throwing out "GDPR!!!1!" are the privacy law equivalent of sovereign citizens.
GDPR is actually very strictly and aggressively enforced in any case where you can actually get the state apparatus to bother doing something. You would need a solid case and a willingness to bang your head against the doors of bored, feckless bureaucratic middle-managers for a few months at bare minimum to get something going, but when the ponderous mechanisms of state kick into gear, they hand out things like 350,000 euro fines for a single security camera displaying a sliver of a neighbour's empty driveway for an hour a week. It's not even legal for me to write down my neighbour's address without their explicit consent under GDPR.