The difference between investment to collect data and investment to protect dat is there is no ROI for compliance (in any compliance domain) so the capital is not easily available.
Instead of punishing companies for existing in the universe and subject to the laws of thermodynamics, the most effective compliance regimes help transition companies proactively to lower the pain which will lower the cost to GDP and thereby angst from human beings.
The GDPR body won’t even answer basic questions like whether IP addresses need to be retained or not because of the competing requirement of the EU security directive.
They have had 23 years too to prepare for this change. And they own the privacy directives. You’d expect them to be better prepared themselves. But they are being kind of arrogant and unhelpful. I suspect because they know they did not make a perfect law and they will figure it out in case law later. This capriciousness is also super annoying.
What EU security directive are you thinking of, regarding IP addresses?
And now GDPR can bundle both together, so that the ROI for collecting data pays for the cost of handling it reasonably, because otherwise you can't collect it.
It levels the playing field and fixes the broken incentive structure around data collection.