As so many people here bash and misunderstand the GDPR, I can tell you why. I leave the surveillance out.
What I man by (probably) unlawful is not that they wouldn't have the right to collect that data due to public interests. And I am sure many locals wouldn't bother sharing their data with the city if it helps to improve its and hence theirs transport system (like it probably does). But you'd have to reverse engineer the app to see whether the data goes also to ad-tech and who knows who else. That's one thing.
And also a telecom has the data due to different obligations. But they also do business with it. That's the second thing. Also the smartphone manufacturer probably has it, and that's the third interesting thing.
But, now, under the GDPR, none of them "own" the data because it is your personal data. With this point, please also stop using the term PII. This covers anything and pretty much everything; like the author, I am interested in the geolocation data but I'm sure there's a lot more interesting stuff.
Then, under the GDPR---because it is your personal data and it "belongs" (for a lack of a better term) to you---you'd want to exercise the many rights granted to you by the laws, the GDPR and the Charter. Particularly, you'd want to exercise your rights to have your personal data and transfer it to another system in a portable manner. In fact, you want it real-time through a 24h API because it is your fundamental right.
Then, assuming you have your personal data from the city, from the telecom, and from the smartphone manufacturer, you can compete with them, do AI/ML with your personal data, do crowd-sourced science with others, do open data with open source, donate it to your favorite city in Europe or even the EU, or, hell, even sell your personal data if you want to.
That's why I wrote unlawful (probably).