The battle of power: Enforcing data protection law against companies holding data power

The EU General Data Protection Regulation (2016/679, GDPR) was enacted to regulate digital platforms who process excessive amounts of personal data and dominate today's online markets. However, the has not fully succeeded in meeting this goal. This article argues that effective regulation should be based on understanding power these companies hold. power, stemming from control over data, weakens monetary sanctions due monopolistic position have obtained by processing, reduces accountability democratic processing practices, limits individual one's own data. sets apart other calls for sector-specific protection rules platform industry.