GDPR also doesn't forbid individuals to do pretty much anything. Article 2c "This Regulation does not apply [...] for a natural person in the course of a purely personal or household activity;" - you can speak freely and disclose information you have observed/recorded, but the business you are running can not.