If it's true, it's not GDPR. GDPR explicitly does not apply to personal use. There can be other laws that apply here. I am not a lawyer.