Also there are plenty of gray legal areas. Often the questions are, "Is this really breaking the law? What is the risk?"
And even in cases where the managed 100% wants fully comply with existing law, there are still tradeoffs. How much do we fund internal enforcement and will that prevent us from being competitive? Which isn't so much about actively trying to break the law, but willing to risk that breakage will happen, or even naive trust of employees.
