The GDPR is possibly the greatest gift ever granted to large tech companies. It ensures new entrants have little chance of ever being able to claw their way up to threaten established players. I could be totally off base but it seems to stem from a mentality that views businesses with suspicion instead of necessary tools for people to engage in meaningful contributions to society. Surely this could've been drafted in a way that scales responsibilities up based on user-base size or some tangible metric that correlates to impact. How will EU citizens be served if the only providers available are unassailable behemoths?