I just received a #GDPR notice from my bank, and it's the first one I've seen that said they simply removed several bits from their privacy policy.

I guess it means the things they previously promised is now legal minimum so it's redundant to put it in the policy or something.