I’ve used similar systems recently in Europe so it would appear GDPR is cool with it...

It seems they are simply asking for identify verification by sending the photo to a remote DHS server for verification. How is this different than showing a ticket agent your passport and having them scan it? That’s the same photo in question. GDPR doesn’t get you out of having to verify your identity in person against a government photo for boarding a flight.

In fact, one could argue the method in question is actually more secure and private because you never actually have to share your passport photo directly with JetBlue.