(also applies to GDPR, and even though GDPR has wider applicability, devs should focus on the low-hanging fruit first instead of going around in what-ifs and exceptions)