I understand your point, but this isn't a special risk introduced by the GDPR, and from the perspective of a regulator, I don't think they are going to consider the linking someone to illegal behaviour to be additional liabilities for the company suffering the breach.

That being said, if your "chan" provides a safe haven for illegal behaviour, you might have other non-GDPR problems as well.

I see what you mean. As an explanation of how a GPDR regulator would view things, what you say makes sense.