Earlier quoted context omitted.
Can you say specifically what goes too far? I don't find it onerous or unreasonable at all, but my business model doesn't improve by violating it either.
How do you know you aren’t violating it? Even with the best of intentions, these laws can be labyrinthian and ambiguous, and therefore expensive to (try to) observe. And there is still always the risk that you are found guilty of something. For a small or medium business, you are likely to be far enough out of the radar to avoid issues. But as a large company you may easily end up in legal crosshairs, costing million…
We've had no more than two disputes since the GDPR was passed and they both ended up with a simple "Please remove their data and make sure that X services are deactivated too when the user fills their consent form".
No scary lawyers or multimillionaire suits. I guess that part is reserved for those that consciously decide to ignore the rules.