It seems fairly consistent, doesn't it? CC 2.0 is that the government must be able to access things, and GDPR has a legal basis exemption that is defacto used every time by government entities. The general idea is that private parties cannot consent to things to each other but that residents of a place consent to being governed by the government. e.g. you can't consent to having someone jail you; but you also can't opt out of jail by the government.

Personally, the politics of Europe is really not for me, but I can see why others might find it attractive. In the end, history will show us which path is adaptive.