Regarding

GDPR doesn’t apply to personal use, in the current form, this should exempt ssb.
However, if someone ran a company that used ssb data, it probably would.

I think @Rabble has been thinking about this a lot.