Because the GDPR requirements are vague, overreaching, at odds with best practise and not yet even implemented by the misguided legislature that wrote it.