Have there been any statements by the people or institutions behind the GDPR on what the expected effect on open source software projects will be (e.g. the described issues are an intended/unintended side effect, the issues won't occur because ..., they consider the issues irrelevant, ...)?
1: Also see: Contract necessary for the most basic processing under GPDR? on Law SE
2: Note that I'm not referring to the few high-profile projects out there that are backed by foundations and such.