This is the type of law that only starts getting regularly enforced when there's a big headline worthy egregious privacy event that happens, that prompts the authorities to have to posture to save face and pretend they're acting to protect the well-being of the people. Until then, it isn't going to be meaningfully enforced, it's too comically absurd to be worthy of the effort for now. Enforcing it now would be herding cats. To do it properly they'd need a sizable target or three to hammer down upon, to scare everyone else into compliance; those target/s will be connected to the source of said egregious privacy violation, that will be the chain of events.