Or even simpler - they can just claim to implement it but still store your data just because.

Doesn't seem like government is taking any steps here to try and regulate anything anymore. Possibly not ever again.