Agreed. I work in information security (risk, compliance, and governance) for a EU-based company and we have a ton of “our lawyers said X” and “we interpret GDPR as Y” kind of policies because there have not been enough court cases to really understand what GDPR actually means.

From a security and privacy standpoint I think it’s got great potential but there are too many open questions about enforcement and it muddies actual compliance.