How active is the data protection authority/courts in bringing enforcement action for breaches of data protection or other laws?
What are the general factual scenarios that could lead to an enforcement action? That is, would an employee need to report a suspected violation to the authorities? Can the employee sue the company directly? Do Data Protection Authorities conduct audits or other regular reviews of processing?
Please specify factors that might influence the outcome of a theoretical enforcement action, such as: history of enforcement action by the Data Protection Authority in your jurisdiction; seriousness of breach; resource levels of Data Protection Authority etc.