Not all private data is stored for commercial reasons. People themselves want to store their lives, make use of advancement in IT and improve their lives. Now what about those data ? If its stored in a computer connected to internet then its at the risk of data breaches. Its even easier as a typical user is not capable nor can he detect such attacks (see botneting toasters).

So if the rationale for GDPR to reduce data breaches or to deny private data to future rouge govt, then it fails. Private data will still exist even if its not commercialzed. Its irrelevent who control it (user or company) as long as its connected to internet, there is risk of data breaches.

Unless you propose to go back to storing actual photos in actual albums. ITT im not sure.