One often wonders whether lawmakers heed their own advice here with what they create.

Well, not really: That's the constitutional court's job.

Your points are well argued - especially regarding the ethical and social implications of what we create, and I agree with them, however we have differing definitions of "small" in this context.

Your arguments apply to things that are maturing and are reasonably big already, but big things have small beginnings... and the internet/web is a fantastic place for nurturing those very very small ideas for basically free, this law appears to threaten those small ideas.

I personally find regulation like this abhorrent and against my morals. Sadly I don’t have the money to fight the EU so my creations will be blocked to its citizens going forward.

The end result of this is that EU citizens will be the ones that suffer from lack of access to technology and the smart ones will end up VPNing into non-EU networks to stay on the cutting edge.

Right, because everyone who lives in Europe is too incapable of coming up with technology and businesses themselves (that have the added benefit of being GDPR compliant) and without access to American firms they will surely fall into a technological dark dark age.

Instead of viewing GDPR as some nightmarish spectre coming to ruin everything, why not think of it as a potential opportunity? You're familiar with making money in a borderline no-holds-barred approach, now try and come up with some innovative business ideas that _don't_ rely on scraping and selling as much data as mechanically possible to prop up a business. This is a great for the disruption hackernews loves so much.

Cite one EU startup that you’ll miss if the issue was reversed.

That's the best way to think about it. When the EU started imposing VAT taxes on non-EU companies on internet sales to EU customers, a bunch of businesses sprouted to handle all of that accounting for you. (So instead of me selling my software online directly, technically all of my EU customers now buy from a US company called FastSpring instead. Fastspring remits VAT on EU sales for me so I don't have to deal with EU tax law, just my own Australian tax law.)

There's probably similar opportunity for a GDPR service that stores customer data via API service, that shields small / micro businesses from all the GDPR compliance. (Eg all your personal Wordpress blog comments are actually stored, hosted and served by a service that handles GDPR modal-consent forms and deletion requests on your behalf.)

>... now try and come up with some innovative business ideas that _don't_ rely on scraping and selling as much data as mechanically possible...

The problem is a lot of us who would never scrape or sell data and have no interest in exploiting our customers, are still worried about not being GDPR compliant, and the EU choosing to pursue us an example for something that none of our customers actually care about.

Why would you be worried about being pursued as an example? Is there any data that supports this as a reasonable fear? Isn't this exactly the "GDPR is a nightmarish spectre that can destroy anyone at any time" mentality?

This is a relatively simple regulation that basically required anybody processing user data to do so responsibly. How does one have an ethical objection to that?

Alternatively, hire a lawyer, like you would for any other regulatory requirement.

Far better details? It gives vague info on what might be considered personal data... I would not call it very detailed. In most cases just says personally identifiable information.