The gdpr is ill-specified for starters. The commentary conflicts with the law itself, and the law makes it nearly impossible to know if you're dealing with a gdpr data subject.

I firmly believe that companies need to protect their data better as the consequences of loss aren't shouldered by them, which the gdpr says nothing about.

I also firmly believe that it's their data. When I send data to another machine, I was never under the impression that said information was mine. I was never under the impression that anything I have on Facebook was ever or will ever be private. I consider order information vital information _of the company_. When I choose to load thea Google analytics tracker, I have no notion that I own that tracking information.

Splitting basic infrastructure like backups and logs by customer or introducing a whole system of flimsy cryptography to support that is no where near reasonable and well beyond common decency.

Explaining all uses of data and why decisions are made isn't common decency. Again, I sent you my data, it is now the server's/company's. I expect them to do what they will with it.

The gdpr is well intentioned, but ultimately nothing more than toxic smoke and carnavel mirrors. It is an underspecified mess and burden creating the notion that you can renege on data you send someone else.