I've seen this argument used many times against GDPR regulations. Who are obligated to provide an alternative? And why? It's not like the police is obligated

I've seen this argument used many times against GDPR regulations. Who are obligated to provide an alternative? And why? It's not like the police is obligated to give drug abusers something in return for the drugs that they are confiscating.