Personally to me it does look like that's the idea. GDPR might be a good idea but compliance with it for small bussiness is very hard. Pretty sure that to this day if you actually audited them a lot of would get fined, as it can only trully be understood by lawyers, as most laws do. Personal interpretations of it "It's not hard, just do x..." don't matter, what courts think matter.