Isn't it at least part of the problem that data laws/regulations remain fuzzy and complex? I don't think it's surprising to see that companies don't fully comply with a law that was created in 2016.