The GDPR hasn't been used much against anyone yet. It is far too early to draw any meaningful conclusions about what sort of real threat it does or doesn't pose and to whom. That ambiguity is itself a big part of the problem, because if you don't know how far you have to go to be compliant or what the real risks are if you get things wrong, you can't make informed decisions about anything you might need to do.
If you don't do enough, you face the prospect of severe penalties. The GDPR's defenders can claim that enforcement will be reasonable and proportionate, but the fact is that the maximum potential penalties are written in law, and it's not as if national authorities have never been excessive with their EU-derived powers before. On the other hand, if you do too much, that's wasted time and money, possibly it's limited useful data processing more than you were actually required to, and now you're at a competitive disadvantage.
The issues about filtering user-supplied content that arise because of the proposed copyright changes are directly analogous. There are vague suggestions about proportionality, but no-one really knows how this would play out, and the potential harm to anyone hosting other people's content if the new laws were interpreted in a different way could be severe.
