> or that it's mostly common sense to tell what you do with other people's personal information

We had a very restrictive privacy policy. We never shared or sold any information with third parties. We contractually stated this.

But that’s not enough for GDPR.