Are those regulations adequately enforced? Lots of smaller developers out of jurisdication, and lots of bigger ones treat it as a cost of doing business: the data is worth more than the fines.