Just a note here that we considered this in some depth over on https://meta.discourse.org and I ended up building a Discourse plugin to assist with GDPR compliance. It's being used a fair bit.
https://meta.discourse.org/t/legal-tools-plugin/87966
There was a fair bit of discussion around this point prior to the development of the plugin, see e.g.
https://meta.discourse.org/t/providing-data-for-gdpr/83595/23?u=angus
As [deleted] mentioned, it's easy for misconceptions / misinterpretations to arise in this space. I happen to be a lawyer in Australia (as well as a developer), which helps somewhat, albeit I'm not an expert on EU law.
I'd be happy to help with the development of a Flarum version, but I'm not an experienced Flarum extension developer, so if someone more experienced is still keen I could assist.