[retromario]

A few examples which benefit citizens:

* Websites are required to clearly present what information they store and track. They are also required to provide an option of functionality without ad tracking technology. The UX problems have been discussed ad nauseam, but from a pure requirement, this is a net win for citizen's data privacy and data tracking transparency.

* Internet companies are required to report and delete all citizen's data on request. This is a huge win for citizen's control over their own data. While companies like Google had already started to become more transparent on the data they collect from their users even before GDPR, this specific law spurred a huge increase in functionality in order to meet the full requirements.

* The fact that it has forced major international companies to provide these data transparency and deletion features to all users is a net win for all, including non-European citizens.

* Companies (and government institutions) are required to publicly notify any breach of data within 72 hours.