I agree and can somewhat chime in. I am not a lawyer. I have spoken to folks that would be involved if we receive an NSL. We would obey the NSL regardless of GDPR. For standard legal requests, I am not sure of the current status of what we would do. AFAIK no U.S. company will risk disobeying the gag order and compliance aspects of a national security letter.