When Cariad had a data leak, they were really quick to point out that no payment information had been leaked. That really shows how little they understand about PII. Screw the payment information, I'll just cancelled that card and get any abused funds refunded by my bank, that's not neither my problem nor my concern.

For some strange reason most companies do not understand the inherent danger of having e.g. location data and behavioural patterns leaked. That's much much worse than you stupid debit card number.

There is a very clear definition of PII so I don’t see this being a problem

GDPR is useful because it defines what must be protected (or avoided). It’s straightforward to do the right thing as a company.

To make it stricter or pack a bigger punch, there needs to be stronger mandate for such legislation. And we live in interesting times… wars, previously democratic allies disintegrating, useless right wing or russia-aligned governments and MEPs, etc…

So yeah, could be better but all you and I can do is talk to our MEPs, help inform people outside tech, vote this way and hope enough people share the concerns