Yeah, but when the practice of this is different with it often being up to regulators what actually is allowed and what isn't. The obvious recent example is that GDPR enforcement is (often intentionally) not strictly following the letter of the law.
Well, GDPR is not actually a law, but a framework that must be used by EU member states to implement their own laws. That may be one cause of local enforcement being not fully aligned with GDPR.
But yes, the local GDPR laws do seem to be intentionally underspecified, like you said.
