[kodablah]

Others are giving an optimistic interpretation. Here's my pessimistic one (at least in the GDPR's case): they want the wiggle room to subjectively apply these rules on companies they don't like. The intention may be valid, but with the boundaries vague you can bet that enforcement won't be uniform. It never is and history has shown how ambiguities in law can be bent for targeted application based on political will.

Also, most comments will say this is just how it has to be because the law cannot be very specific on highly technical matters. I believe that part is true, but it is not just how it has to be. The other option is the absence of the law and alternative measures to tackle this problem (e.g. education/awareness, encouragement of alternatives, public equivalents or assistance w/ caveats, etc, etc).

[billconan]

Really good points.