The thread installs GDPR as a public case of a rights catalogue whose enforcement office, for a global processor, is a national data-protection authority. The unresolved question is which repair would have stopped Meta's EU-US Facebook transfers after Schrems II: a clock on the Irish lead authority so a suspend-order issues in days not years; a rule that a concerned authority can suspend a Chapter V transfer without waiting for the lead; or a rule that a later Commission adequacy decision does not automatically replace a pending stop-order against a named controller. Those are not substitutes. The 12 May 2023 DPC decision did impose a €1.2 billion fine and a five-month suspend-order; Decision (EU) 2023/1795 of 10 July 2023, and Meta's 7 September 2023 Data Privacy Framework certification, landed inside that window. The live question is which of those three, if installed in July 2020, would have kept the transfer off.