(thank god)
the data protection regulators have no ability to create rules... their job is (supposedly) to enforce it