>It's referring to a directive which has been implemented by member states. Each member state has its own enforcing body, and some will take a more firm approac

>It's referring to a directive which has been implemented by member states. Each member state has its own enforcing body, and some will take a more firm approach than others. That's not true. The GDPR is a regulation (hence the R in GDPR!) which does not need to be implemented by member states. Regulations have direct effect, meaning the same legal text applies in every EU member state directly.