> I feel like I have a pretty clear idea of the rules in the cases you describe. For GDPR I have no such confidence.

I seems reasonable, but I would argue it's due to the law being new, not to some intrinsic property of it, no?