That's a fair point. It isn't public information.

But, GDPR applies to any information, even if it isn't available publicly.