Exactly. There has to be a framework that everyone has to follow. Imagine we had no laws against theft and you would get into trouble only if you overdid it by some undefined standard
No, it's like inviting people over for a casual party and then recording everything from 15 different angles, including in the bathroom, and then hiring a few people on every street in the town to photograph everyone walking down that street so that you can cross-reference those photos to your candid bathroom shots.
And then you let some other people get those photos because "Chad who was at that party said it was OK with him".
GDPR isn't very effective in that regard. 98% of Facebook users will just click 'Agree and Continue' when promoted, giving Facebook the legal right to buy/sell whatever data they want.