The EU should do a unionwide ad campaign pointing out the fact that the much-maligned eurocrats have actually been working for years to fix this very difficult problem that's only now becoming apparent to the wider public. The timing couldn't be better as GDPR goes into effect just after the Facebook/Cambridge scandal.

Unfortunately all EU institutions are terrible at marketing. If they did an ad campaign, it would probably be a TV commercial showing Jean-Claude Juncker giving a speech with subtitles in 15 languages.

That "hard part" is going to be more than just hard; I think the word you're looking for there is "impossible". They don't have any way of knowing what data Google, Facebook, Amazon, or any other company has. As this article does a credible job of explaining, you have to understand a fair amount about statistics (PCA) and machine learning to even know if if you were looking at it, and they won't know where to look for it. They have no enforcement mechanism in mind, and they passed a law anyway, which effectively means "you can't admit to having this", which will mean that the more willing a company is to lie, the bigger an advantage they will have over their competitors.

Sure. But at least when they are actually whistleblowed (by people who "just" work for the company) there is a law which can be used to call to a court the theople who are legally accountable for the company