

Companies generally do not use ‘VPN services’, they maintain their own VPNs. This is what makes them virtual Private networks. The data retention laws are aimed for the ‘VPN providers’ who use the ‘VPN’ term for a different, very non-private services, used to circumvent geolocation and make tracking (even lawful) by some parties harder.
I do not say those services should not exist (there are legitimate uses for them), but do not mix them with actual private networks.

Which would mean they are moving in the wrong direction. Death penalty is a tool of totalitarism, not a characteristic of a healthy democracy.