They're not surprising if you assume the ground state for every company that does not fear the teeth that come with this legislation is malice. They're doing the bare minimum they need to so they can pretend to think they have complied if anyone knocks on their door, while still trampling all over everyone's rights.
