There's so many caveats, clearly it's a question of practicality and doing what's reasonably possible to abide by the new law.
It would be interesting seeing the exact wording on the new legislation, so are there exceptions, what's considered "data" and what reasonable measures are expected...