> There’s a get-out clause in the law

As all too common

GDPR: "legimate interest"

EU261: "exceptional circumstances", no deadlines for paying compensation etc

yes yes, "no law is perfect" etc..nobody could foresee anything...downvote away

> GDPR: "legimate interest"

It doesn't allow spying though. It allows, e.g., to save your session if you intentionally logged in.