So there's effectively a blanket exception for the organisations you really don't want to be doing this, ie. Police, the institution itself and government? (incidentally, government is your health insurance company in most of Europe)

I keep coming to the same problem with these regulations. I am much less afraid of Amazon/Google/... figuring out something about me and using it to sell me stuff than I am afraid of the police doing the same, and arresting me or otherwise having a huge negative impact on my life. Knowing the police, they'll probably not even do AI monitoring correctly, and of course, won't be responsible for the damage they cause.

Frankly, that Amazon and Google figure out stuff I might want to buy might actually be a positive. Maybe. Sometimes. If they become better at weeding out scams, that is.