For example, I'd be quite happy to let my local supermarket sell my personal data to Google in exchange for a 3% discount on my grocery prices. Everone would benefit: (1) The supermarket gets an additional source of revenue; (2) Google can charge more for ads; (3) The toothpaste company gets better return on it's advertising; (4) I pay less for my groceries.
GDPR prohibits this kind of win-win agreement, doesn't it?
Of course it's completely impractical to get cashiers to do this every time someone buys something, so it will likely just be applicable to store reward cards. They're doing this already, and all GDPR will introduce is moving the paragraph in the TOC you sign which says "we might sell your data to third parties" to the top in big letters and make sure you explicitly agree to it (or similar to achieve informed consent). As well as adding some safeguards in place.
A point on your example, stores already do sell your personal data to third parties as an additional source of revenue, but instead of giving you a 3% discount they usually just analyse your purchasing habits and throw discounts on other goods which they think you'll be susceptible to buying, so usually instead of you spending less you actually spend more on things you didn't really want before being offered.
2. GDPR does not prohibit this agreement, but it requires the company to get consent from you before selling your personal data.
Advertising doesn’t help manufacturers make more or better goods. It just helps them sell them at the expense of others. Advertising is a deadweight loss, a competition between sellers that leaves them all worse off.
> It seems to me that GDPR restricts economic growth.
It does, but fortunately economic growth is not the central point of human existence.
It plainly does. It trades profit and economic potential for privacy, there's no question about that. I've seen near universal agreement from EU persons that that's a desirable trade in this case.
It gives US startups an immense advantage. They can grow far more profitably in the very large homogeneous US market, unhindered by GDPR-style restrictions & compliance, and then take their scale/resources and project into the rest of the world and comply with local requirements.
That US advantage will get larger by the year, as the globe perpetually fractures more and more on compliance requirements. It's going to become more difficult to operate in all foreign markets, as regulations for online services grow nearly everywhere. Most nations will put up barriers of compliance that will have a tangible cost. Europe will have numerous different GDPR-like regulations among its nations. There are 50 countries in Europe and only 27 are in the EU, that guarantees a messy, fractured compliance zone overall.
This is only the beginning of what will be a dramatic reshaping of the way you could formerly build once in almost any nation and easily go global with a service, that will become impossible without considerable financial resources.
It won't be: comply with GDPR and you're good. It'll be: build 50 different compliance systems to reach into 100 countries. Only very rich tech companies will be able to do it, something the US particularly specializes in building.