There's always a reason for expanding government bureaucracies. Some worthy problem, which the government plausibly could solve if it had just a little bit more power to intervene.
That doesn't change the direct consequence of the intervention, that there's now yet another area where the government sits there telling everyone what to do. If we believe that government ought to be limited, at some point we have to balance against that.
In my country, EU privacy laws applied by our National Data Protection Commission have prevented and pushed back against multiple governmental plans (cameras on the street, sensitive questions in the census, mandatory reporting of certain personal banking data, etc). Is that an increase or a decrease in the reach and size of government?
Well, when they were talking about it becoming fully active not too long ago there was a lot of talk of fines being "the last resort" after warnings and whatnot -- then you have multi-billion euro lawsuits on the very first day the regulators could go after the corporations.
Governments are exempt from GDPR. Further it is regulators, not individuals, who determine which data processing activities are lawful. GDPR certainly takes power away from companies, but it transfers that power to the state, not to individuals.
The GDPR does apply fully to government agencies, some requirements are even stricter (e.g. they always need a Data Protection Officer). Most agencies had to alter their policies because of that. What is true that there can be special purpose laws giving a government agency the power to process some data (e.g. by tasking them with collecting some information, such as say your income for tax levying). Member states can also pass laws to overwrite portions of the GDPR for some listed purposes, such as public security but those don't apply to the vast majority of governmental data processing. Naturally, that makes the government more powerful than private companies but certainly not more powerful compared to a time before there were data protection laws.
While those are valid points, it does also empower the individual. Being able to ask a company for their data on me is a huge boon that's gonna change the game.
