[hugoromano]

It is the member state authority, although EU GDPR is a Directive, is up to the member state. It doesn’t just apply to the EU, it can be UK ICO.

[istinetz]

I have literally seen EU institutions fragrantly break GDPR