we're not a lawyer, what we're about to say is an oversimplification, but not a horrible one...

Irenes (many)

all they really do is say that companies have to actually know what they're doing, data-wise, have to keep track of it

that's what you would need to someday enforce future rules that outlaw specific malfeasance, but there is barely anything actually defined as malfeasance as long as you keep records of what you did