GDPR will change that. Fines of up to 4% of global gross should make them adhere.