GDPR has enough holes that governments can continue to expand surveillance as they wish.

Most notably there is a government shaped hole in the GDPR. Governments are largely exemt from it. And companies are allowed to collect data they are legally required to collect, so delegating the work still works if it's done by law.

Still a massive improvement over the previous status quo, data collection is now much more transparent which makes it easier to oppose.