The GDPR seems to have many companies changing their policies and behaviour, and it's not even active yet. So there's that. I'm sure they'll be plenty more data to be gathered on the consequences of those rules the next few years.
Technical measures can also be effective, but they usually suffer from the problem that each individual must know about the threat, must know about the technical solution, and must use that solution, which usually requires some effort. I see very few people arguing that health inspectors ("policy") should be abolished and every individual should be responsible for not eating at unhygienic restaurants, even though there are technical solutions one could use that would allow someone to mitigate risks in such a scenario.
Technical measures can also be effective, but they usually suffer from the problem that each individual must know about the threat, must know about the technical solution, and must use that solution, which usually requires some effort. I see very few people arguing that health inspectors ("policy") should be abolished and every individual should be responsible for not eating at unhygienic restaurants, even though there are technical solutions one could use that would allow someone to mitigate risks in such a scenario.