I certainly agree that it's a continuum, and that an attempt to remove all judicial discretion will yield an impossibly long law still full of loopholes. (As an

I certainly agree that it's a continuum, and that an attempt to remove all judicial discretion will yield an impossibly long law still full of loopholes. (As an aside, I think this is why cryptographic smart contracts are grossly oversold.) The GDPR just seems unusually close to the lawless edge of that continuum by the standards of a Western legal system, considering the vagueness of the rules and the severity of the statutory punishments--20M EUR for a small company is a corporate death penalty. But again, you don't need law to do business. I can visit countries where people face the literal human death penalty with negligible due process, and still feel quite confident that I'll be fine. By the standards of worldwide lawlessness, the GDPR is great; but that's a pretty pathetic standard.