[Breza]

It'll be easy to enforce for most corporate clients. I work in a profit-driven corporation that's now owned by a private equity firm. We try all sorts of things to make money. But there's no way we'd deploy a legally questionable model, even if we thought nobody on the outside would ever find out. I was our technical lead for GDPR implementation; we took all sorts of steps to make sure systems were compliant even when there was approximately zero chance of anybody on the outside ever finding out if we hadn't. The buy-cake-for-money-launderers companies flouting the law are an exception, not the rule.