GDPR is not the issue here, the new AI act is. Since this is an open-weight release it is not bound by the training data disclosure rules, but it probably didn't go through the evaluation that is required above a certain number of FLOPs. That's why many recent big player model releases had a staggered release in the EU.