> Is it natural for people to assume that these laws are broken at such a large scale? And that abuse goes completely unchallenged for years?

In Germany where data-leaks (which are a symptom of insufficient data protection) at telecommunication providers seem to happen on the regular, with no (reported) punishment as a result, yes I think that is a bit naive.