> that we're not going to be a target while some of the ambiguities get worked out in courts.

I posited this to our counsel when discussing what to do about GDPR. He cautioned that he’s seen investigations start due to a nosey bureaucrat.

I don’t know if your product is public facing, but if it is, all it takes is a single sufficiently powerful government employee to get curious about your business and start asking questions.

Even if you’re not doing anything wrong, having to engage counsel to respond to the government could get pricey.