They are. You just need to tell them what you want to do with their data, and then do what you told them you were going to do. And not something additional ("oh hey look at all these IP addresses stored for security purposes, I bet we could make funny graphs about Bob's sleeping schedule too!") That is apparently too hard for many companies, so now this is codified in law and can actually be enforced.
There are some additional clauses like right to view your data, correct it if incorrect, and remove it if there is no longer a need for it... but that has existed in Dutch law since 2002 and few people ever exercise it. I recently did for the first time when I found out someone was doing WiFi tracking based on MAC addresses (I didn't remember giving consent), and I got an email from them (which looked like it took 15 minutes to look my data up and type it out), so it's not such a big deal.
The law has a bunch of unintended consequences that are about to be unleashed. Or maybe, they are consequences that are fully indended: a de facto trade barrier against non-European companies who’s own laws conflict with GDPR.