Would it be bad in this case? We have a chronic problem of lack of GDPR enforcement and it's clear regulators are underfunded/incompetent/overwhelmed/not interested in doing their job.

If the regulators can't, let someone else do the job.