That "hard part" is going to be more than just hard; I think the word you're looking for there is "impossible". They don't have any way of knowing what data Google, Facebook, Amazon, or any other company has. As this article does a credible job of explaining, you have to understand a fair amount about statistics (PCA) and machine learning to even know if if you were looking at it, and they won't know where to look for it. They have no enforcement mechanism in mind, and they passed a law anyway, which effectively means "you can't admit to having this", which will mean that the more willing a company is to lie, the bigger an advantage they will have over their competitors.