I am not saying that this is an excuse to not protect the data.
I am saying in general that GDPR has not been thought through enough and has been pushed without consideration for a lot of edge cases.
"Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the government for a redress of grievances."
The first amendment also contains not much consideration for edge cases. That is a feature, not a bug.
GDPR sets principles, it isn't a technical specification. The edge cases will be sorted out by courts, as usual for legal issues. Meanwhile, everything looks like that the EU will not immediately start to impose big fines if there are small gaps, as long as affected institutions and enterprises show effort to comply and to fix remaining issues.
I disagree; all complex laws. That's the main reason for the existence of supreme courts; to decide on a reading when courts below disagree ("circuit split", in the US).
My claim is that you can't avoid it. It's like trying to write a large program with zero bugs without being able to test it. Citing Knuth, "beware of bugs in the above code; I have only proved it correct, not tried it."
To put it another way: can you cite any complex bill that hasn't ever gone to the Supreme Court?
