Hacker News Reader

However, GDPR is a regulation, not a directive. I haven't seen that countries pass their own implementation of it.

Each country-specific privacy org gets leeway around rules like legitimate interest.