I saw a presentation on this the other day. Some interesting things:

• GDPR doesn't apply to personal use, in the current form, this should exempt ssb.
  However, if someone ran a company that used ssb data, it probably would.
• GRPR applies to any one physically in the EU, you don't have to be a citizen, just physically there.
• there are a variety of reasons a service can store or process your data under the GDPR. that you consent to it is the most flexible, and gives the most rights to the user, but there are other reasons like "legitimate interest"
• everyone talks about the right to delete, but there is also a right to data portability. That means you can request an export of your data, so you can transfer it to another service.