> requires collecting and protecting data
Thanks to OSA, service providers have to collect even more data from users, including face scans and IDs. They usually outsource that process to third party companies, which obviously are registered in Cyprus or another shady country. We can expect a massive leak in a near future, and no one will be prosecuted, though you will receive a letter from the government saying: "We are really sorry for the leak of your data, we weren't able to get in touch with the data processing company, so we kindly ask you to revoke your passport and apply for a new one. Stay vigilant as someone might use your identity for illegal purposes".
> including vulnerable groups like children
The "vulnerable group" is proficient at using VPNs. Ironically, the new law affects older generations the most.