The spirit of the GDPR is "do what we think is right even if we don't really understand what you really are doing - we have very fancy principles but no idea how to implement those, so we'll impose a ton of crazy measures hoping to move the needle, and failing miserably".

As a European, I don't really care of the spacetime position of the magnetic moment encoding if I clicked in the big red button or not. It does not change anything to my life. What I do care is that my sensitive data are kept securely. And even my government if failing to do that, so before they impose anything to the latest SAAS I subscribed to, they have a ton of work to do in-house.

I also care about what people post about me, but GDPR has an exemption for public data, so I am not more protected today than I was yesterday.

I am sure someone, somewhere feels all warms and fuzzy about "protecting" the European citizen, but boy did he miss the mark.