The GDPR has brought some improvements for consumers and workers (e.g. stricter requirements for consent, involvement of responsible parties from third countries, and dissuasive sanctions). Overall, however, the legal position of consumers and workers has not improved significantly and many of the concerns of consumers and workers respectively described in this position paper have still not been met in practice. We see the reasons for this in enforcement deficits, but above all in the inadequacies of the GDPR itself.