I'll give you a specific example. David Simon of The Wire talked about the longshoreman's union in Baltimore in a UC Berkeley lecture titled "The Audacity of Despair", available on YouTube. It's long but excellent. At 36m30s

https://m.youtube.com/watch?v=nRt46W3k-qw

In it, Simon mentions that the union was so corrupt that every day it had to forward a copy of documents -- possibly every document produced or received -- mail, memos, publications, P.O.s and receipts -- to either the DoJ or the state's AG office, under a consent decree. Basically, because of a long history of abuse of power the union had to run open books to law enforcement.

The financial world operates similarly: companies are subject to audits (by private companies, not even government agencies, though those companies are themselves audited) for compliance with accounting practices and such. That is, again, you open your books.

Regulation of other organisations operates on similar grounds. Pharmaceutical companies are regulated as to their drugs produced, food processors to their own practices, especially in beef, dairy, pork, and poultry. Some industries gain exceptions to anti-trust regulations in return for more regulation and oversight of other elements: major league sports, insurance (underwriting boards), telecoms, and transportation (rail, truck, air, sea). An item which popped up following Trump's request for followers to patrol polling places was a specific injunction on the GOP for doing just that dating to the early 1980s (and set to expire Real Soon Now, though Trump may just have fouled that up). Southern states in the US have operated under injunctions dating to the Voting Rights Act for violations of its provisions (some of which may have expired or been reduced by recent SCOTUS rulings, I've not kept close track).

Google itself is already operating under a consent decree running for 20 years until 2031 as a result of "deceptive privacy practices" (that's the FTC's language, not mine) in rolling out its Buzz social network:

"FTC Charges Deceptive Privacy Practices in Googles Rollout of Its Buzz Social Network"

The mechanism for enforcement:

The settlement requires the company to obtain users’ consent before sharing their information with third parties if Google changes its products or services in a way that results in information sharing that is contrary to any privacy promises made when the user’s information was collected. The settlement further requires Google to establish and maintain a comprehensive privacy program, and it requires that for the next 20 years, the company have audits conducted by independent third parties every two years to assess its privacy and data protection practices.

https://www.ftc.gov/news-events/press-releases/2011/03/ftc-c...

It turns out that people have faced the questions of trust, verification, audit, and compliance for a long time. Trust, third parties, bounties, and similar mechanisms are typical modes for ensuring compliance. There are ways of determining if personal or private information has leaked (look up "fictitious entries" or "honeytraps" -- I've made a recent HN submission on the topic though it didn't go far). And yes, there are times that the auditors themselves are corrupt: Arthur Anderson and Enron, Ernst & Young HK and the Mozilla v. WoSign and StartCom CA backdating scandal. Mozilla will refuse to accept further audits from E&YHK, meaning that E&Y effectively mined its own credibility to generate present business at a cost of any future trust (I'd really like to see what the future fall-out of this is).

Yes, passing effective laws is PRECISELY how you constrain technology.