Critics call proposed changes to landmark EU privacy law ‘death by a thousand cuts’