I would give the legislators some credit there. While it is certain that the lobbying has been fierce (as with any legislation) and that no law is going to be p

I would give the legislators some credit there. While it is certain that the lobbying has been fierce (as with any legislation) and that no law is going to be perfect and make everyone happy, it is a bit of a tall order to expect the lawmakers to anticipate all sorts of crazy business models and legal theories someone could come up with in response to the legislation and prevent them. That's just not realistic, esp. not when technology is involved which evolves at light speed compared to the comparably glacial tempo of regulatory and legal world. E.g. GDPR has been proposed in 2012, adopted in 2016 and fully in power since 2018. I.e. the entire process took over 6 years! Where was e.g. Facebook or Amazon in 2012 and where is it today? What about siphoning of (also personal) data by various AI training systems - is that covered by GDPR too or not as they are not really "stored" in the resulting models? Not something one could ask the legislators in 2012 to anticipate, really.