Privacy and security is good. Massive government powers, controlled by unelected bureaucrats, are not.

The EU is ultimately looking to exert de facto censorship control on the internet. We see it in the way they are demanding that outfits like Google globally delete legitimate information under their  made up 'right to be forgotten' (which is also partly a component of GDPR). While they have created some new 'rights' there is no real free speech protection.... news media are regularly banned from reporting some crimes and events (and police are raiding private individuals who dare post those stories on social media), the next goal is to block those stories at the chokepoint (social media organizations), and the mechanisms in GPDR provide the tools to do that.

GPDR is the benign carrot. Watch out for the stick.