The lawyers and Data Protection Officers can wield the GDPR against any blockchain if they decide to do it. This is why I launched a "Call to arms" and pleaded for blockchain project teams to come together and agree on a strategy as soon as possible.
There are ways to deal with this challenge but if left to fester, problems will arise. The "tragedy of commons" I fear can gain hold here is that no one wants to stump up the necessary resources to build this defense group against self-serving interpretations of GDPR by vested interests.