Re: he is missing the lowest hanging fruit
"Exactly! If a user des not want his data stored, how do you ensure that???"
Easy: Under GDPR you only store the data of those who have given explicit consent for their data to be stored.
Consent is not fungible (meaning someone else cannot consent on your behalf), so all of those contract terms in the T&C where "you confirm you have permission to share someone else's details" have zero legal validity.
The next step along the GDPR path will be for someone to challenge those clauses and attempt to get the T&C declared void.
Biting the hand that feeds IT
