I rather think it gets a lot of hate because it leaves a lot to the discretion of the regulators. Overall, the SMEs I talk to don't have a problem with regulating data (most think it will pop the gangrenous ad-tech bubble). It's the lack of predictability that bothers them.
"You're making efforts to comply with the regulations, but could you have a look at how you're storing this and that?"
vs
"You're not compliant with the regulation so we have to impose a fine"
Are you really saying you'd prefer the second?
People are rightfully worried about "you followed the law completely but we don't like it so massive fines!".