I think it true in the technical manner. You can try to find it in the actual GDPR but that hard if you aren't a lawyer the UK ICO has a neater article on this:

https://ico.org.uk/for-organisations/guide-to-data-protectio...

Basically you just need to declare them in you privacy policy and keep a record for compliance.

In terms of LI though it's really complicated and I don't think anyone here on this site is in a position to say for sure if LI applies to what OpenAI is doing. There are arguments from both sides that make sense.