Thanks for the direction. I've read the GDPR a few times but it is (intentionally) non-specific on many implementation details. As I alluded to in comment, 17.3(a) seems like it would work as a global excemption in practice. I'm not familiar with how court rulings that provide legal precedent have impact or are respected across the diversity of legal systems across the EU. By May 25th 2020, after a multitude of GDPR related cases and verdicts, the answer may be more clearly defined. (Or increasingly nuanced with even greater uncertainty ;-)