Is there no organisation with power to police this? In the UK we have the ICO and if we're not satisfied with the response to a FOIA request we can escalate it to them.