The GDPR act clearly does state that though, so if they are not trying to do that, why did they try to give themselves the authority?

This isn't just my take by the way, it's common knowledge and was the cause for much discussion and speculation.