I still have no idea what to do exactly. I don’t really think it is my responsibility but I live in a country and operate in another country where laws this vague are unenforceable.

It doesnt apply to security-related services, and the governements are allowed to override it for most purposes as outlined in article https://gdpr-info.eu/art-23-gdpr/

1. Each EU member state has a different legal framework and so a Regulation (which has direct effect, meaning it applies as-is and does not have to be "transposed" into national law) would not be appropriate when dealing with criminal investigations;

2. The EU can only act in areas where it has been given "competence" to do so under the Treaty on the European Union and Treaty on the Functioning of the European Union. Member states are reluctant to give the EU broad competence to establish criminal offences or to regulate the investigation and prosecution of offences;

3. The treaties explicitly exclude almost all activities related to national security because that is a fundamental feature of being sovereign, which EU member states are and the EU is not.

Due to points 1 and 2, the EU passed the Law Enforcement Directive (2016/680/EC) which regulates processing of personal data in a law enforcement context. Being a Directive (and not a Regulation) means that each member state has latitude to adapt it to their respective legal frameworks when transposing it into national law.

Incidentally, point 3 will cause huge problems for the UK when we eventually leave the EU. The Court of Justice of the European Union - the EU's highest court - cannot take in to account laws of a member state relating to national security (insofar as they _only_ relate to national security) due to their exclusion by the treaties, but they can take in to account laws of a third country.

https://twitter.com/bainesy1969/status/1001902266620764160?s...

> ICO rules that ICO failed to comply with timescales laid down in the FOI law that ICO regulates link: https://ico.org.uk/media/action-weve-taken/decision-notices/...

This, for example:

> Germany's spy agency can monitor major internet hubs if Berlin deems it necessary for strategic security interests, a federal court has ruled.

> In a ruling late on Wednesday, the Federal Administrative Court threw out a challenge by the world's largest internet hub, the De-Cix exchange, against the tapping of its data flows by the BND foreign intelligence service.

> The operator had argued the agency was breaking the law by capturing German domestic communications along with international data.

> However, the court in the eastern city of Leipzig ruled that internet hubs "can be required by the federal interior ministry to assist with strategic communications surveillance by the BND".

https://www.yahoo.com/news/german-spy-agency-keep-tabs-inter...

Also see the much controversed "legitimate interests" exemption to GDPR that has been carried over from the 1995 EU directive.

My point is that Europeans overall are more comfortable with government snooping, and less comfortable with snooping by private interests, than Americans are. In practice, of course, American government agencies snoop far more than European ones do, but the American ones must be more covert about it.