As an easy example, the commerce clause in the US constitution has come to mean something that no layman would ascribe to it.

Another easy example in the opposite direction is how case law has substantially diluted the meaning of words like "infringe", "unreasonable" and "excessive" in amendments 2^1, 2^2 and 2^3.

Any support for that statement?

[0] https://en.wikipedia.org/wiki/Dormant_Commerce_Clause [1] https://en.wikipedia.org/wiki/Civil_Rights_Act_of_1964 - "... principally its power to regulate interstate commerce"

Whether or not you agree with that interpretation, it would take some willful ignorance to say that the plain text reading of regulating interstate commerce means you can regulate all commerce because you might have bought something from someone otherwise

See Wickard v. Filburn.

At least that's the logic of the court.

This is stretching the law beyond any reasonable interpretation, done so by the same government who gains a lot of power by doing so.

If a started a business that picks peoples noses among multiple states, would Congress be able to regulate nose-picking by individuals on their own private property?

There will always be exceptions and details argue over and ultimately you need a critical mass of society to agree to abide by them to a great enough degree.

Expecting any reasonably non-homogeneous society to be able to agree on where to draw lines what constitutes bad behavior in anything other than the obvious cases ( murder, theft, etc) is naive. Expecting laws to cover the vast majority of bad behavior is naive. Expecting to be able to enforce that theoretical set of laws is naive. Expecting to enforce those theoretical laws without creating something akin to 1984 is just insane.

However, the law could still certainly be shortened and simplified. The GDPR is written in plain English.

If you previously had some private data in your core databases that you used for all kinds of things, finding an exception that allows you to store this data for security purposes doesn't allow you to continue business as usual - it won't permit you to use it for marketing purposes, for example, just as an exception that allows you to require and store some data that's needed to execute the service won't permit you to sell that data to third parties as was common practice earlier - for that you'll need to (try to, likely unsuccessfully) obtain the user's consent.