>I’m not confident in anything I’ve written ever to have it picked apart by a team of expert witness programmers.

Then you shouldn't be handling PII, any more than you should be handling credit card details, genetic information or military intelligence.

>Maybe that means I have no business working at a startup. Maybe we should think about the implications of that.

The EU has, and has decided that having seen the alternative, it would rather just not have the startups. I think that's a reasonable position to take.