If the guy is high enough up in the hierarchy, there's a good chance that he can sign off on even illegal things.

Looking at how Google is handling the GDPR, for example, there's just as well plenty obvious violations that someone had to sign off on and that are gonna cost them a few billions once they can't drag the lawsuits out any longer. In the meantime, though, they're very likely making enough money to offset that, which is why executives can sign off on illegal things in the first place. It's just a basic risk analysis in the end.