GDPR enforcement is left to the member states. The EDPB isn’t an agency, its more like all the national data protection authorities in a trench coat.