Privacy legislation - a bit of a farce?
Underfunded regulators, perpetrators allowed to negotiate their penalties, and at least a few extraordinary decisions.
For example, I have an official ruling from the ICO that it's legitimate to conceal processing performed on the basis of Legitimate Interest. This is strange to me, as data subjects have a statutory right to object to processing on that basis. The ICO specifically nevertheless considers it "sufficient" for a data controller to provide "examples" of its processing on the basis of Legitimate Interest, which effectively means that the data controller can simply not mention some of such processing when a data subject exercises their right to be informed.
I may possibly have missed something obvious, but it's not clear to me how one can object to something one hasn't been told about. It therefore seems that the national regulatory body is advocating that data subjects be denied a statutory right.