To what extent is your startup's business dependent on violating users' or others' privacy? Will it be uncompetitive if they don't? It's a broad question, not

To what extent is your startup's business dependent on violating users' or others' privacy? Will it be uncompetitive if they don't? It's a broad question, not a legal one. If the answer is: it's very important, because our competitors will violate and win, then EU probably expects to apply industry-wide regulation. If the answer is, not much or we don't know yet, then just don't. Please. Law and money are certainly important, but there's other important things too. Look at it from the regulators' perspective. Regulators will always lag nimble startups. But if those companies are violating reasonable and widely-held priciples (perhaps not the law, yet) how should the EU best apply those principles into law? I find the vagueness of the GDPR exactly satisfies this dilemma.