The problem is that in order to do anything even slightly meaningful like displaying profile pictures you need to grant the right to store and process. Since it

The problem is that in order to do anything even slightly meaningful like displaying profile pictures you need to grant the right to store and process. Since it is hard to keep track of distributed data at scale and some data being quoted by other users you need these rights indefinitely. The problem is of course the generalization of data in conjunction with generalized rights gives away de-facto everything. On the other hand narrower general terms risk creating liabilities for companies. I don‘t think building rules based on low level technical functions for a portfolio of high level applications is feasible. Honest actors in their natural interest to self protect have created a legal framework which allows bad behavior by bad actors (or their future bad selves). Not sure how a future framework could look like but the evolution of RBAC may give some clues. Data probably needs to be labeled. Processing needs to be tied to intent. Acknowledging that rules for larger datasets must exist and need to differ by size.