Which is why the EU doesn't use a letter-of-the-law system, and also have an ethics regulation system. So it falls on those misusing the data, unless you knew

Which is why the EU doesn't use a letter-of-the-law system, and also have an ethics regulation system. So it falls on those misusing the data, unless you knew it would be misused but collected it anyway. Golden rule: Don't need the data? Don't collect it.