You can do this already with the existing Data Protection Act. Businesses have not drowned in subject access requests. People seem to forget that data protection isn't new, it's just being beefed up a bit.
See "Europe vs Facebook" for another pre-GDPR example where people were obtaining data Facebook stored on them via existing data protection laws: http://www.europe-v-facebook.org/EN/en.html
