In a way, that's fine. You don't need to prosecute all offenders for a law to be useful. The law gives you some way to shut down bad operators which otherwise w

In a way, that's fine. You don't need to prosecute all offenders for a law to be useful. The law gives you some way to shut down bad operators which otherwise would be difficult to stop. Compare tax law. By law, anyone profiting from illegal activity has to report it as income on their taxes. This isn't because they actually expect anyone to report it, it's because it gives another avenue for prosecution. It's worth noting that this distinction between who technically isn't complying and who will actually get prosecuted is a big part of why people have such different feelings about GDPR. Some people are focusing on the difficulty of complying and the penalties that could be assessed; others are focusing on the unlikelihood of small, mostly-compliant, well-meaning operations being targeted. Also worth noting, this kind of selective enforcement can absolutely be used in a harmful way or have unintended negative consequences. I'm just trying to point out why a jurisdiction might pass a law even if they don't expect anyone to abide by it.