There was already european privacy legislation which was just as strict, and companies like google and facebook already had been fined under those laws (though not to the degree that GDPR allows). What GDPR does is harmonize this kind of legislation across europe. You can argue that it is now easier for startups to build a product that targets the european market, since there is only a single set of rules to follow.