Well, this is not really a thing to describe in a social channel, my fingers will bleed :) But I will give it a try;

The link I use as source is this one; http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679
It is the official publication. Chose your language and stick with the PDF (by some reason the PDF and the HTML versions does not have the exact same content, that will be fun for the lawyers). At least I will only refer to the PDF.

There are no single person on earth that know how this shall be interpreted. It is a new regulation and there has been not trials in any court what so ever. We are all guessing here. While I do GDPR analyses for a few companies right now I might anyhow be right or wrong in my statements. We will need to make a good guess and adjust when predicates (?) are concluded.

Social networking is one of the targeted subjects in terms of Facebook, instagram etc etc.

It targets not only the IT-part but also the business part as well. This is not a IT-regulation.

The entre regulation is quite nicely concluded in article 5;

1. Personal data shall be:
(a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’);
(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).

Processing is about everything you can imagine + some more.
Personal data is anything that can identify an individual, and if I have a strange car with a unique color that is personal data as well.

All processing must be lawful (Article 6) and this is where the consent (Article 6, §1a) is the most suitable for Hubzilla nodes.

I have conclude the entire regulation is a huge Archimate model, unfortunately that is all in Swedish. But there is a few activities that a hub owner must carry out thought they must not be overdone.

• One have to acquire mandate to steer how information are processed within the frames of responsibility. This is a fluffy one, I know that, but if you have a Hubzilla Hub you must now how to control access to the DB. If you are a manager, you must have mandate of those in the organization that processes the information. No big deal for the hub-owner I think.
• One must deal with the Purpose of processing the information. Facebook have a problem here - it is not for you to show of the bbq, the horses or whay I think of Trump, it is to sell individually targeted adds and sell information about you. Hubzilla have in general a simple purpose; to allow members of a hub social networking fair and square. But it MUST be concluded and expressed.
• One must make a risk analyses that also brings up the consequences for the user. What if the system is hacked? What if the server at my dining room burns, what does that mean to the user?
• One must secure that one have evidence to the above is managed and how that evidence is managed
• One must have a preparation for incidents. Incidents must be reported within 72 hours, where depends on the country.

@Philip Wittamore ;
I have my familly-hub (ridderby.se) which is purposed social networking within the family. Here I won't need a consent, it is most likely within the family. I also agree that I would be able to post a picture of my wife on my social network on Facebook by the information you mentioned.

I am also hosting a hub that is a bit more open (askeröd.hubzilla.se), that is not social networking within the frames of the family. Here I will need to get some consent from each and every user.

But then again, we are all guessing here.
@christian
Hubzilla will need to make a statement on what information is collected and how it is spread. So does the IPS as they might otherwise collect and use the information. One important cornerstone It is to be open and honest to the user so that the user willingly and knowingly consent to the processing.

The functionality I mention is to support automatic collection of consent. You may also ask your users for consent using other methods and collect the answers (you must be able to provide some evidence that you have done so).

The information provided to users are well defined in articles 12, 13 and 14. 12 states that we cannot do as Microsoft usually does, hide this information in a 27 page document. It must be clearly stated and easily readable.

I think we might be able to ask for a broad consent from our users while we sort this out. We will have many common answers but they will not be identical.

Now I need a break.