In most countries, regulators are given broad authority to issue supplementary rules, explaining exactly what's required or forbidden to comply with the origina

In most countries, regulators are given broad authority to issue supplementary rules, explaining exactly what's required or forbidden to comply with the original law. The goal is that people who know a lot about data privacy, rather than random EU representatives, can figure out the specifics.