I wonder of some of that doesn't come from different interpretation doctrines in different places. Under teleological interpretation used in practically by all

I wonder of some of that doesn't come from different interpretation doctrines in different places. Under teleological interpretation used in practically by all relevant to GDPR courts, there's more flexibility than mechanical direct wording approach used in some places - and practiced by many PCI implementations and auditors to the point of being a running joke in some circles. A basic guiding principle with GDPR can be considered to metaphorically make "personal data" toxic, something you want to deal with as little as possible (with "sensitive private data" being extra toxic), with goal of preventing profiling and other abuses. Significant majority of business processes do not actually require sensitive data. A company that does not handle sensitive data does not even require a DPO. Similarly, the flexibility means that as a company you can make a point of showing action in good faith, while regulator does not have to update the law for every possible new detail. Consider for a moment that GDPR provided, on average, about ZERO new requirements compared to previous law on the books. Yes, zero. If anything, it cleared up some questions from before. The big difference is that previously, most member states law had consequences for non-compliance that were pretty much ignorable especially for bigger companies. The cottage industry that sprung was majorly oriented at extracting as much value from the panic, and in fact often increased said panic on purpose. In fact, if you're in B2B market, you might have close to 0 work anyway. The big problem was that with extremely lacking enforcement before, corporations built up, often unknowingly, huge amounts of mess and now someone started considering that the fines might be substantial.