See above my comment about practicality. It takes no effort for me to not violate your first amendment rights. It's a negative right, not a positive right.
You're making the wrong argument. You're saying "this is not a right that can logically exist", which is nonsensical. Of course it can. What you should be arguing is "this right is far too burdensome on society and should not have been passed". I personally disagree with that, but it's at least a valid argument.
Larger businesses (250 employees or more) may need a privacy policy though.
For example the law itself says: The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned.
The UK's IPO for one example definitely doesn't agree with your assessment of the GDPR and it is their job to help companies adhere to it.