This isn't Sarbanes–Oxley, this is literally don't be stupid with customer data.

> "but We Tried and then We Kept Trying"

Will literally get you 100% of the way there if done in good faith. Crypto-shred anything you acquire from an end user and you are good. Collect the bare minimum to offer the service you claim to be offering, and you are good. Alert the customer on how their data will be stored, used and fused and you are good.

Of all people, programmers should stop whining about how hard and oppressed their lives are. The EU is telling you to stop being a clueless *sshole. If you even attempt to stop being one, you are fine.