Trivia: Norway is not in the EU, but they still adopted the GDPR. (A possible practical effect might be implementation differences due to that)

There are exemptions for academic research and journalism in the GDPR under article 85 [0]. That is why the original news article (that I wrote) clearly mentions right away that the information was collected for a academic project.

[0] https://bookdown.org/fede_caruso/bookdown/the-journalistic-e...

Reading GDPR's definition of personal data I think he is safe

GDPR applies to organizations, he is not an organization and not doing it as a business.

He's storing private data that can geolocate people (mac address + exact geolocation + timestamp)

With that you can not identify any individual. You can try to prove that some device was at that location at the time.

Even if he stores private data GDPR would not apply to him as an individual, but other laws may apply depending on the data and the country.