> In particular, “digital artisans” using Open Source software at small scale – the main concern of Debian – will need guidance from the European Commission.<p>Sadly I don't think it will move, the commission doesn't want to weaken the legislation because they don't want to much discrepancy between member states.<p>It will once again be up to individual countries to set up this law with their own interpretation.<p>In my experience with Rgpd, the watchdogs in at least 3 countries (France, Italy, Germany) are extremely helpful in navigating regulations, especially if you are incidentally its target (As a PaaS that hosted health data, we were).<p>I understand that this is both unclear, unknowable and a pretty huge risk (not really factually, but it feels like one): I'm not saying Debian people are wrong to want to clarify, I'm not saying people should take this as a victory, or that EU is perfect : I'm just saying that as a complex federation, with current rules, this law will probably be the best we will get, and sadly, local 'forgiveness' and loose execution is the only thing you can count on.<p>Because in the EU eyes, the law being loose is way, way worse than the local executive power being loose.