Process personal data lawfully | European Data Protection Board with other words, doesn’t apply.
While obviously at the time, 6 years ago, a lot of things were not so clear (because the law hadn’t actually gone in to force yet and no rulings based on it had occurred), I don’t think that the general take on how it applies to OSM has changed.