To me, the amazing part is how contradictory CSAM and GDPR are and few seem to be pointing this out.

Isn't personal privacy the overriding objective of GDPR?

Isn't the effective result of the proposed CSAM to eliminate personal privacy?

Over time, laws tend to approach the point where everyone is a criminal.