Unimaginative is the wrong word, imo. GP is calling out that over-regulation introduces market hurdles for smaller businesses. This is a known and non-controver

Unimaginative is the wrong word, imo. GP is calling out that over-regulation introduces market hurdles for smaller businesses. This is a known and non-controversial fact. Typically it gets addressed by instituting different requirements for various key metrics like company or user base size. Article 30 of the GDPR states that companies with fewer than 250 employees do not need to keep processing records unless “the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data…or personal data relating to criminal convictions and offences.” Your point about an authoritarian government siphoning user data from companies which siphoned that data is also possible and valid.