GDPR is handled by the state - no idea how/where frivolous part comes from. The people can file complaints with the state/agency but not sue companies directly on their own for violations.