Oh, I'm very aware. My own (EU!) company has ISO certifications that "guarantee" our customers that all their data is perfectly protected.

It is not. We, among other things, have plaintext user/password combos in scripting. Certain logs are certainly not being processed lawfully.

It's also not so bad as to be terrible but it still irks me a lot that we're essentially lying to our users.