The Commission’s plans to shape Europe’s digital future aim at increasing the generation and availability of data. The strategy to achieve this goal is underpinned by the belief that the GDPR generates the trust required to drive more demand for data-driven technologies, as well as more data-driven competition and innovation, an outcome purportedly compatible with the protection of individuals’ personal data. This article exposes the flaws in this rationale, noting that the GDPR neither generates trust nor stimulates data-driven competition. Crucially, on the most fundamental level, the protection of personal data and the promotion of consumer welfare in data-driven markets pull in opposite directions. Since the GDPR is both failing to protect individuals against the privacy risks posed by current technologies and serving as a regulatory barrier to entry that favours established dominant platforms, the EU should reconsider the current personal data protection mechanisms to arrive at normatively consistent outcomes capable of affording effective data privacy protection and improving the competitiveness of EU firms.