GDPR is designed to not simply accept that "Peoples lives and most intimate details is going to be stored as bits. Get used to it." but instead try to change that.

Changing that is nontrivial, since it requires changing the behavior of everyone handling this data - so, something that can be done only by law. It will restrict Facebook, it will restrict Strava, it will restrict data stored on remote servers and home. While it won't affect likeliness of data breaches, it will affect the impact of data breaches - realistically speaking, many of the breached companies should not have had most or even all of that private data in the first place.

A data breach can't reveal information that you don't store; so a push to ensure that less companies are storing sensitive data, and those who do are storing less of it - that's something long overdue. GDPR is not designed to have people do X, Y and Z so that they can keep doing business as before; it's designed to ensure that many (most?) places where private data is used simply stop doing so.

Not all private data is stored for commercial reasons. People themselves want to store their lives, make use of advancement in IT and improve their lives. Now what about those data ? If its stored in a computer connected to internet then its at the risk of data breaches. Its even easier as a typical user is not capable nor can he detect such attacks (see botneting toasters).

So if the rationale for GDPR to reduce data breaches or to deny private data to future rouge govt, then it fails. Private data will still exist even if its not commercialzed. Its irrelevent who control it (user or company) as long as its connected to internet, there is risk of data breaches.

Unless you propose to go back to storing actual photos in actual albums. ITT im not sure.