Not only that, laws have a tendency to set a particular model in stone.

The model large companies use is to collect everything they possibly can and then use bureaucratic processes to control access.

The model small companies and individuals use is to minimize the data they collect and use technical means to ensure that the company has no access to the customer's data at all. This obviously tends to be more secure.

But if the bureaucratic process is required by law regardless of whether it's really protecting anything, the more secure model becomes impossible -- you have to collect all the data because it's the only way to make enough money to pay for the bureaucratic overhead.