Just looked at this site:
https://www.itgovernance.eu/blog/en/does-the-gdpr-apply-to-meIt says:-
To fall within the remit of the GDPR, the processing has to be part of an “enterprise”. Article 4(18) of the Regulation defines this as any legal entity that’s engaged in economic activity.
======================================================================================================
So since CA doesn't really have economic activity and it has zero employees as far as I know.
Of course we have a Sell and Swap board but it's not really CA Selling or Swapping it is the members.