For example, one of the requirements is that a person should be able to reach out to a company and get all of the personal data the company holds about them (plus be able to amend or delete their personal data).
HOWEVER, the bar for identifiable data is so high (anything that can identify an individual, within the context), that you can easily call up and get information on anyone else, and abuse these rights.
The same laws that are supposed to protect people, are actually exposing them. An enraged spouse can easily gather data on their partner’s whereabouts by calling up with their partner’s MAC address.
Also, the burden on companies to deal with this is so unreasonable. I understand giving people rights as to how data is used, but to have on-demand access to everything one keeps about you? Really? If you want to know what others (including organisations) know about you, keep a track record for yourself.
Can you imagine if someone walked up to you and asked you to immediately forget everything about them?
I am not trivialising the matter. Organisations are like people. When you interact with them, you give them information. But to place the onus on organisations to keep track and allow you to manage all of your past interactions is highly unreasonable.
The economic effects of court cases that relate to these regulations, as they start to unfold over the coming years, will not be positive in the slightest, I believe.