I don’t think the problem with GDPR is that it is lacking rules.
I get that. I'm saying that what you think is missing in existing privacy laws, actually already exists.
I don’t think whether or not such a rule is a part of gdpr is very relevant to the effect of the rules on people outside of the regulated businesses in practice.