[tremon]

Actually, the GDPR only defines a minimal baseline for all the EU countries to meet. And countries didn't need to update their own laws to match it: since it is a Regulation rather than a Directive, the GDPR is enforcable in the entire EU even without a local law supporting it. Countries are still free to enact stricter policies if they want to, but those obviously wouldn't apply outside their own national borders.

[ben_w]

Thanks; appears I got what "regulation" meant exactly backwards relative to the alternative.

I think it makes the conclusion stronger, in this case, but regardless, thanks :)