The title is kind of misleading considering that the article clearly states that GDPR doesn't apply to European institutions. (Apparently European institutions are "'separate' from GDPR for 'legal reasons'" and "subject to a new law that 'mirrors' GDPR which will come into effect in the autumn".)