"Get explicit consent for keeping data"
Thats the problem the internet runs on data and who decides what data is personal. For the past 20 years the MPAA has argued that IP's are personally identifiable and have won this argument in court cases, of course this is silly as it would make the internet illegal but that wont stop someone who has no idea how the internet works.
The EU has tried to fix privacy on the internet before with explicit consent of cookies, now every website tells you they can use cookies and gets a default ok, I agree, go away popup, from every user in the EU.
Will this stop facebook from spying on people tracking stuff that has nothing to do with facebook like who you phone? Nope, they make billions from spying on you and will spend a few million on lawyers to find them a loop hole.
Edit:
Someone in the office just had to accept a new privacy policy from Office 365, I assume its because of GDPR. The privacy policy was 25,000 words long, we don't have the legal knowledge or time to read and understand that. We have work to do so it was just accepted blindly.
What data did he explicitly consent to Microsoft keeping? Without a team of expensive lawyers we don't and won't know.