I always wondered about that. If a closed source app keeps my data in their silo, but I own the hardware their software runs on, I can't do anything with GDPR? Aren't they the controller if they run the software?

Exactly. We're not owners of that data, they are. Should be an extension of the regulations IMHO.

That's also my "HO" but I was more wondering how to interpret this from a legal perspective. I've read large parts of the GDPR law but don't (at least off the top of my head) remember anything that would say either way.