The EU is revisiting GDPR and the only certainty is that there will be changes made to legislation. As things sit currently, not all the member states agree on a lot of pretty basic things like what age a child can consent to have data collected and under what circumstances or what constitutes a public person who has different protections than a private person.

Given the widely varying statutes in some countries, it seems highly probable that the EU will refine GDPR to address a lot of these harmonization issues. However, some member countries, have laws that are stricter than GDPR is currently. If harmonization among the member states is to be addressed, it seems likely that they move toward the most strict interpretations.