I can't answer your question but I'd like to note that users are not always employees.

Yeah, well, even if it is an open source project, what about git? You can't remove an arbitrary commit in the tree. I'd argue discussions about code follow under the same umbrella.

I really thing people are taking this GDPR thing WAY too seriously. They are really only going after the obvious abusers, IMO.

They can be.

I doubt it. I've read the 66 page standard and I remember something about "records required for business", ie transactions, tax info, etc. I'd argue employee conversations would fall under the same umbrella.