Yes, beautifully said. They can however “by design” allow business / operators of clients or relays to comply.

Lets also not call it GDPR :). Seeing such discussions in Japan and all over.