Once the data is out there, though, you're vulnerable. You can "destroy" it later, from the perspective of a company, by asking the company nicely to destroy it for you, but that does nothing to protect you from state actors who may have had access to the data before. In fact, a state actor would likely take "asking nicely to destroy data in accordance with the rules and regulations" as a signal of which data was the most interesting to collect and retain.

GDPR provides a legal framework through which Europeans are able to get companies to honor their wishes with data .

While it has teeth, it does nothing to physically stop a bad (or unconcerned) actor from don't something you don't want with that data, and once they have it you can't put Pandora back in the box.

Computers are machines for copying data. A good computer is one that copies well, quickly and cheaply. The internet is a machine for moving copies of data around. When the internet works well, it copies data quickly and cheaply.

Ideologically, this is difficult for some people to accept. If your fortune has been based on stopping people from copying information, it is an inconvenient truth indeed. If you earn your living by preventing copying, the only options are to change everything, or deny everything.

Copy killers, Cory Doctorow