As far as the public sector goes, however, the GDPR is mainly meant to increase security surrounding citizen privacy. You can’t demand to have your criminal record deleted for instance, and there is a range of privacy data like that which serves a purpose within the public sector. The EU is fine with that, and possibly more so than the US, but the EU does want to keep it safer than has previously been the case. Mostly because the European public sector didn’t meet really take these security requirements seriously enough on its own. The GDPR didn’t really change the rules for the public sector, it rather increased the penalty for not following them.
There is an old saying that in the US people trust their corporations and not their governments. It’s the opposite in Europe.