Hacker News Reader

GDPR applies to organizations, he is not an organization and not doing it as a business.

He's storing private data that can geolocate people (mac address + exact geolocation + timestamp)

With that you can not identify any individual. You can try to prove that some device was at that location at the time.

Even if he stores private data GDPR would not apply to him as an individual, but other laws may apply depending on the data and the country.