> To comply with GDPR, we have to know where PII comes and goes, and over 80% of that data goes over HTTPS. That means that for any company to be able to comply

> To comply with GDPR, we have to know where PII comes and goes, and over 80% of that data goes over HTTPS. That means that for any company to be able to comply with GDPR, they have to inspect all HTTPS traffic. Fine. A company can inspect their own traffic. This doesn't mean that _other_ companies should have the same ability, including upstream providers. > Not only do we have to MITM everything, but we're making security worse, and breaking apps. Sounds like what most of the "security compliance" certifications actually do.