The problem is that the only way a lot of these EU regulations can get through is by general directive: the intents and goals are agreed upon as a group, the implementation is left to the individual state. You can imagine how impossible it would be to get all European countries to agree on anything otherwise. On top of that, a lot of these rules do really need to be adapted to local national contexts to makes sense.

However, that also leaves plenty of room for exploitation, like the stuff you mentioned. I'm sorry to hear the GDPR is being abused this way.