>>izacus+(OP)
Not really. GDPR establishes specific rules around data protection and retention, but what I am proposing is having them establish a contractual obligation to abide by their claims with pre-defined damages in the event of a breach of contract to demonstrate a commitment to their claims. GDPR is about data protection, this model is about honesty/fulfilling obligations which just so happens to be about data protection in this case. If they want to gobble up all the data and they are completely honest and forward about it such that the average impacted individual properly understands the scope and degree of what is occurring, then I do not care too much about it since at least everybody is going in with open-ish eyes. It is doing so while lying about it or appealing to people's wishful thinking then blaming them for not reading the fine print that is truly evil.