> An .. institutional deficiency was trying to make the GDPR as completely general as possible rather than doing a technology mandate.

Making it a technological mandate would have made it trivial to circumvent.