your argument applies exactly the same to GDPR, entities that do not engage in collecting or processing personal data have no reason to sweat. Those who are following the law that had been introduced in the EU in 1995 either.

Had you read the GDPR you'd knew that punishment is proportional to the offense, had you read the regulation in charge of receiving complaints you'd know that they said they will first give a chance to comply to the law before resorting to punishment. The only ambiguity is in the broad term "legitimate interest" offering exemption to GDPR.