You may also want to take a look at the opinion of Article 29 WP about ‘legitimate interests’ — WP 217, 9 April 2014. I am not sure if this is a viable path for most businesses. But, we’ll see… I fully agree, however, that GDPR Model is far from MyData.