They could/would/should but clearly don't so loopholes will be exploited. If it is illegal what will be done? Will schools be prosecuted for former breaches? Edit - what is the point in legislating but not monitoring and taking action? It appears that the regulators have taken their eye off the ball and themselves should be investigated, they have one job... to regulate and they are clearly unable to fulfil that brief.