I'm not sure what you're looking for here. If your position is "it should be difficult to make a company that has PII" you won't get any significant AI or consumer tech companies in your jurisdiction. That's just reality, they use PII, they personalize on PII, they receive PII, that's how they work.
If that is your goal, OK, that's a choice, but then you can't say "oh GDPR fears were overblown". They caused exactly the problems people were predicting, and that's what EU leadership is now trying to change.
This notion that tech companies or even internet companies somehow fundamentally rely on PII is false and just an indicator of how normalized we've let unbounded and needless data collection become.
There are tons of business that can run without collecting any or extremely minimal PII. We already let the big companies take this data unnecessarily, let's not also let them brainwash us all into thinking unfettered surveillance is somehow essential to building a software business.
> If that is your goal, OK, that's a choice, but then you can't say "oh GDPR fears were overblown". They caused exactly the problems people were predicting
I feel like, there's nothing in my statement you can actually disagree with, so you're just expressing general frustration with the state of the world.
That's fine. You can set up aggressive PII laws, you're a big boy sovereign nation. But then you will not get domestic tech giants. That's not like, my opinion, that is the reality we are in.
I am describing that reality, and that the EU is unhappy with it, and your response is "Here's why we set up laws!". OK. I'm not sure what you are looking for here. We all know how you got here.
If that is your goal, OK, that's a choice, but then you can't say "oh GDPR fears were overblown". They caused exactly the problems people were predicting, and that's what EU leadership is now trying to change.