However, as a citizen of EU member, I’d say GDPR pretty well aligns with the general notion of the people.
Sometimes people ain’t happy when government uses GDPR as a scapegoat to keep iffy data private. E.g. hiding final beneficiaries of companies. But I don’t see people unhappy that GDPR prevents crappy software practices.
Same deal as credit cards. Here in Europe cards processing fees are capped. Thus we don’t have US-style kickbacks or points programmes. Which probably limits credit card issuers innovations and business models. But I don’t see people complaining about that.
If so, I stand corrected.
If not, it was performed by representatives whose incentives are not aligned to the electorate (see Arrows impossibility theorem).