That's a difficult one; if the GDPR's law exempts them from the same responsibilities, you probably have to look higher - like a constitution of sorts.