Privacy is the point but enforcement is very much lacking. The GDPR is supposed to be enforced by the member states so the EU is not to blame – at least if by "EU" you mean the EU bodies. The EU as a whole, including its members and citizens may be but imo it's more accurate to say that it isn't coherent enough to actually have opinions.