Is there any evidence that this law is achieving the goals it was designed to tackle? If not, is there any reason it still exists? Why don't laws have to continually justify themselves as a matter of procedure?
replies(3):
The only ones ignoring it completely are either dodgy companies, or the clueless. The companies exercising malicious compliance are now (quite rightly) increasingly seen as dodgy and need to up their game if they want to become respectable.
The days of not protecting user data are over.