> Most of the time they don't.
Don't comply? Most of the time?
> Ever wonder why food health and safety inspections discover serious issues in basically all restaurants they inspect?
As a person whose mother has worked at restaurants for over 40 years, and whose best friends owned a restaurant for close to 20, I can tell you that those "serious issues" and "all restaurants" are FUD.
> Most restaurants stay in business because the inspection are generally pretty lenient (issue warnings and don't close the business down)
So you write this ^. And then you immediately go on to write this:
> Now let's try to imagine how a restaurant is going to approach GDPR compliance.
It will be the same: they will get it wrong the first time, get issued a warning, fix it, and carry on.
Don't forget that those poor hapless restaurants also have to deal with:
- handling money
- taxes
- accounting
- labor laws
- zoning regulations
- smoking regulaitons
- fire regulations
- contract laws (becuase they have contracts with many external parties)
And this is why your "most of the time they don't comply" is bullshit is that they do comply, most of the time. And when thry don't, they get issued a warning, fix their shit, or go out of business. This is no different.
And yeah, small business (or any business for that matter) really has no business collecting my private data, and selling it to third-parties.