I'm also curious where other points will land in reality. eg, if I ask Apple to remove all data they have about me, will that also remove me from your address book? If I ask Google to remove all data they have about me, will that also remove any emails you've received from me?
In this light, I'm happy to see the first complaints arrive against Google and Facebook, as they're exactly the examples we all have in mind, and we need to see how they'll play out in reality.
(Albeit, I also trust the European legal systems won't commonly wield the maximum possible fines, but rather seek compliance. The scary big numbers, the source of so much FUD, should be reserved for wilful disregard after this step. "Walk softly but carry a big stick" style.
Their case will be helped by the fact that they can simply have the user “consent” to stuff. And since none of those are “critical” services, they will find ways to prove that user consent was actually voluntary, and not coerced.
So I think you’re right that only the most egregious violations will have real trouble.
The judges might also want to demonstrate to everybody (including their own system) that the big stick can in fact be wielded to real effect. If people start beliving that the stick is really just a prop, no point carrying it, is there…
Article 6 [0] is phrased negatively, making collecting PII illegal unless x or y. These points cover all the use cases the lawmakers deemed valid; a real-estate agent may collect PII because of 6.1b (taking steps to enter a contract at the request of the data subject). Should a new, possibly valid reason to collect PII come up it would first need to be checked and then added to the list.
Since most websites and online services do not aim to form a contract nor fit points c-f, they have to obtain consent by the data subject (6.1a) to make collecting PII legal.
Many common purposes for data processing might come under point f (legitimate interests) depending on the circumstances. Analytics, marketing, monitoring to check for fraud or other abuses are just a few examples.
That’s actually a great point. Collecting PII is NOT illegal, as far as I can see. Nor can it be illegal. Same for personalized ads.
Consider a real estate agent. To show you the right kinds of houses to buy and finally make the contract, they have to have enough PII about you. If they know nothing about you, they’ll end up showing 1-bedroom studios for a family of five and a three bedroom suite for a bachelor living alone. Similar arguments can be made for all kinds of service providers.
Now onto the issue of FB, the only service they offer is “communication tools with built in personalized ads”. PII is necesary to provide that service.