Different political forces with different goals, and GDPR, targeting businesses, isn't fundamentally something the "more state surveillance" group had to preven

Different political forces with different goals, and GDPR, targeting businesses, isn't fundamentally something the "more state surveillance" group had to prevent, even if they wouldn't have introduced it themselves. And the pro-surveillance push sadly is fairly endless, see also countries trying to introduce general recording of internet metadata despite the EU top court repeatedly having made clear that that's not going to be a thing that survives a legal challenge.