GDPR is not strong enough or is it?

Is it me, or do I heave the feeling that GDPR is not strong enough to protect a certain user's privacy?

For example, when you ask google or facebook to remove your data, they won't remove everything.