So maybe the legislation should be that you have to pass a "internet operator" test to get a license that ensures you have the awareness and the skill. Because even if the current law protects you from GA, there are tons of other companies doing the same things and have no intention of stopping.
Better to protect the people from all the bad companies, not just the ones who do business in the EU, right?