IIRC GDPR is even weaker than the German law. EU-regulations usually only define the lower ceiling, and it's up to countries to go with it, or improve it even further.