__Blank__ GDPR is applied, yes, but the concept of lawful use (e.g., health services are lawfully using your health data) allows national law to construct itself. Of course, this is not a flaw in itself (there aren't really too many conceivable other ways to do this, and you usually have to clear some bars to change the law, plus there are options to challenge the lawfulness of new laws), but it does keep the path open for someone to introduce legislation (or interpretations of existing legislation) where people would start to raise concerns. Some of the surveillance laws are examples of this, as you could argue police authorities do actually have a lawful need for broad data collection, and then you need to argue either "yes, but not that broad" or "yes, but only under this supervision and transparency regime", etc. To what you were saying, there are situations where you cannot ask your government to delete your data, for instance, but it requires a provision in law mandating that the data cannot be deleted.