This is not about advertising or any kind of misuse of the data. Rather, IT's role is very much one where they they setup and maintain systems and procedures that process data. It's certainly true that GDPR compliance is something an IT person will have to think about, but making the same employee responsible for auditing that things are compliant is quite a bit of a conflict. Auditing versus accounting is a similar concept.