Yeah. I really like the main idea behind GDPR, which is that data containing PII is the property of the person it describes, not of the companies that process the data to provide services.

This means that I, as the owner of my data, can refuse to provide it for some use cases, request its deletion, etc. It’s my data after all.