I agree that the intent behind that regulation is good and yes, as an ethically sound company you shouldn't have to worry about it. However, the implementation

I agree that the intent behind that regulation is good and yes, as an ethically sound company you shouldn't have to worry about it. However, the implementation of these laws so far has been less than stellar, to say the least. There's a lot of room for interpretation and some rules are left vague - sometimes intentionally in order to avoid having to constantly update the regulation. Given the huge, potentially ruinous fines associated with GDPR you'd want laws to be as explicit and as specific as possible in order to avoid ambiguity and profiteering. What's more, different European countries have implemented GDPR differently - or not at all. Privacy (or the lack thereof) - in the EU of all places - shouldn't be a competitive advantage or a bargaining chip.