GDPR wasn't put in place to monitor people scribbling down phone numbers on pieces of paper. It was put in place to stop companies from hoarding vast amounts of

GDPR wasn't put in place to monitor people scribbling down phone numbers on pieces of paper. It was put in place to stop companies from hoarding vast amounts of personal data and using it to infringe on people's privacy (as well as making sure they looked after it properly). Sure. The intent of the GDPR has not received much criticism, at least not that I've seen. The concerns some of us have always had are more about ambiguity and interpretation, because on the one hand the law as actually written doesn't allow for much leeway in some cases, and yet on the other hand it has huge ambiguities in key areas hiding behind words like "reasonable" or "legitimate". It's easy to look at extreme positions, such as the example I gave above for illustrative purposes, and say no regulator is ever going to expect all of that. Probably you'd be right. The difficulty is that somewhere between not doing much of anything to comply and the other extreme such as I described, you cross an invisible line from being sufficiently compliant in the regulator's view (or potentially a court's if it really came to that) to not being sufficiently compliant and no-one really knows where that line is. When you have not just the threat of fines but also potentially very significant costs in adapting your systems and processes, that sort of uncertainty is never good for anyone. That is particularly true in a case like GDPR, because many of those adaptations are more about being seen to comply than about fixing any actual security vulnerability or abuse of privacy or other tangible problem.