It’s been three years since the European Union’s General Data Protection Regulation, or GDPR, took effect. At its core, the law was meant to give consumers more control over how companies collect, share and use their personal data. It was the first major privacy law with real teeth in the form of potentially large fines for companies that didn’t comply. But that didn’t really happen until recently. Marketplace’s Amy Scott speaks with Jessica Lee, who advises companies on privacy as a partner with the law firm Loeb & Loeb. She said consumer advocates tracking enforcement have been somewhat disappointed.