Comment by zitterbewegung

I think that Jacques Mattheij has some thoughts about this that you can think about it in the abstractions that he gives. Note that IANAL and YMMV.

EDIT: Also Jacques is not a Lawyer either.

1: https://jacquesmattheij.com/gdpr-hysteria