There is a kernel of truth in that, but lets not forget, that laws alone don't have any consequences. It is the willingness to force people to comply with the law, that has the actual consequences. If our judges and governments and forces in general are not willing to pursue violations of the law, then we can have any law we want, it still won't matter. We do need more law enforcement on GDPR! A lot more.