This is what I'm wondering.

They just need to add the word 'terrorist' somewhere (and then a bunch of ambiguous other groups and loose definitions) and it's enough to get people to look the other way. Because the spooky boogie mans will come and get you! And after all if you aren't a terrorist you shouldn't have anything to hide right? Only evil brown terrorists would use secure channels of communication and encryption, normal law abiding citizens wouldn't dare, or have a reason to.

There are exceptions for law enforcement/intelligence in GDPR. Those are particularly broad in the UK data protection act for example.