I'm not sure I agree with your point Anders (or more than likely I've misunderstood it):
1) As long as the congregations properly inform their victims where their data is stored, how, and why, gdpr is followed.
2) Compare this with web server providers: the providers are responsible for keeping any data stored with them safe, but they are not expected (or even allowed) to honor data removal requests for any of the websites their customers are running on their servers.
1) That's the point. The Rank & File have no idea that their data is stored this way! Even if you're an inactive JW then all your data is still on here!
2) What about all the DCMA notices that Google responds to? The former owner of AvoidJw.org was found out because both Google and GoDaddy ratted him out the moment WT complained to them.