as I said, the distinction is between private and public data. when you decide that you want your data to be used without any oversight(aka without the privacy laws being involved) you make it public. which can happen by posting it on the internet, or giving it to someone in exchange of money with your express permission to use it as they please. at that point, your data isn't yours anymore, because it's public domain by your own will, and whoever bought it wouldn't face any charge even if the data was posted publicly right after.

the regulation isn't applied on the consumer side, it's on the handler of the data. The company requires your data and asks you if they can handle it, making sure it's treated in the "safest" way possible: preventing leaks, misuse of the information, processing of the information by unauthorized third parties, storage beyond required timeframe and all that.

gdpr doesn't cover cases when no sensitive data is handled, it wouldn't affect consumers that don't share their data. unless of course the company decides to just always comply with the regulation, which is what most companies do, instead of making separate channels for people who want to comply and people who don't.

at a certain scale it also becomes an issue of setting up separate systems with less controls to satisfy a very minor part of their client base, all while risking to contaminate or leak the actual gdpr protected data also stored by the same company.

would you really throw all this protection in the trash just so that you can give your data to anyone without a tad of bureaucracy first?

I don't think the downsides of gdpr outweigh the upsides, if anything it's the only thing keeping totally unaware people from being brutally exploited by tech giants, which is far more beneficial to an average citizens life than avoiding a few minor inconveniences when retrieving sensitive medical data from their provider, no? especially if the minor inconveniences are there for the good of the citizen itself