Your comment does clarify the issue by pointing out the alternative, and the article could have mentioned that, but the quoted sentence is completely correct as

Your comment does clarify the issue by pointing out the alternative, and the article could have mentioned that, but the quoted sentence is completely correct as quoted. It fails to mention the alternative, but there's nothing actually wrong in the statement. I'll give you that the article is not very comprehensive, but the GDPR is large and complex and the author doesn't set out to cover it in every detail. What misunderstandings did you see?