Three years since its entry into force, the data protection framework is still falling short proper enforcement.
