When the European Union put the General Data Protection Regulation (GDPR) into force nearly three years ago, the expectation was Europe’s then-28-member bloc would enforce data protection in the same way. Such hopes now look premature.

Neil Hodge is a freelance business journalist and photographer based in Nottingham, United Kingdom. He writes on insurance and risk management, corporate governance, internal audit, compliance, and legal...