As I understand it the information isn't PI and so isn't covered by GDPR.