I have read and agree to the terms and conditions: The General Data Protection Regulation (GDPR) sets out to ensure the rights of EU citizens through principles such as the ‘right to be forgotten’ and restrictions on companies storing personal data of EU citizens overseas. However, detailed interpretations of new laws are lacking, potentially leaving service providers with a lot of discretion in handling and storing personal data. How can the EU regulate data flows in a realistic way, protecting both the rights and freedoms of its citizens online and the openness of the internet?