[Piskvorrr]

"This ruleset you have? Oh, just merge it with the old ruleset; the old laws are not being repealed. Merging is easy, right?"

In other words, it's not a replacement: it is an additional set of rules to keep (although most of it would be a superset of various national laws).

[lokedhs]

It isn't? Are we talking about a different regulation?

I quote from the title of 2017/0003/COD COM (2017) 10:

    Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT
    AND OF THE COUNCIL concerning the respect for private
    life and the protection of personal data in electronic
    communications and repealing Directive 2002/58/EC
    (Regulation on Privacy and Electronic Communications)

Note the word "repealing".

[Piskvorrr]

See, there's this thing called context: the meaning of the word changes through the surrounding words. If there is a word "repealing" in text, this does not usually mean "everything that's related is repealed" - it means exactly what it says on the tin: "repealing Directive 2002/58/EC" - nothing about repealing the existing state-level legislation (to repeat previous context, "It's one ruleset for the whole EU instead one ruleset for each EU state.")

My point still stands - you still need to conform to both GDPR and the state-specific legislation.

[lokedhs]

It may be that I am the one who is misinformed here. My understanding was that 2017/0003/COD was about creating a replacement for 2002/58/EC. I haven't read all the documents, so I could very well be wrong.

But assuming that I am right, then a replacement directive would simply cause the states to update their laws and nothing would really change in terms of complexity compared to the situation before.