To 99% of internet users, GDPR has meant nothing except extra popups, blocked access to some websites, and an additional regulatory burden.
In some cases bad actors exploited GDPR for fraudulent purposes - eg. requesting a full account deletion in the event of a ban. They can then recreate the same account with the same data.