@smiddy3,
Watchtower would love to have zero liability, and with regards to GDPR they tried to establish that in court.
Unfortunately for them EU already ruled that even data collected on handwritten notes by unpaid volunteers is within scope of Watchtower's responsibility and liability, because Watchtower organizes that work, and the data is collected to further Watchtower's agenda.
The only thing that could get Watchtower off the hook if (when?) an individual publishers is caught illegally collecting or leaking data is Watchtower's effort to make sure no data is collected.
Of course individual publishers are also liable under GDPR.