Yeah, this is the really frustrating thing about conversations about the GDPR: whatever you think about how companies should act, legislation doesn’t really matter unless there’s some way the government can take retributive action against those who ignore it. When someone asks about what this mechanism is, you inevitably get a whole host of people assuming you dislike the legislation.