Who is "they" and where is it being ignored? GDPR is quite clear on where it applies.