It does not protect your data, it only allows people and governments to sue corporations who abuse it. There have been some good moves overall when it comes to privacy because of the GDPR, for example the rulings against Google Analytics and Google Fonts. However, the theory behind the commentators statements is that if GDPR was universal, companies would be incentivized to collect less data in the first place, and therefore there would be less data to leak. This may be true in some cases, and it may not be, we know that companies aren’t exactly the greatest rule-followers.
tl;dr: You need encryption to personally protect yourself, you need regulation to see broader societal change.