The GDPR promised to give Europeans control over their personal data and rein in Big Tech—but years of uneven enforcement are testing the limits of that promise.