The plans also include that you have to have some relevant personal relation with the data. This will make it unlikely that an NGO can just request any random data under their staffs name. Additionally, requests should also mirror the real costs, which could go into the thousands or even ten of thousands. This makes it harder to find legit people which are willing to take the risks, even if the NGO could cover the costs.

Of course it's also all just speculation without any real laws written yet, but the direction is there.