How do you figure "the user already has access to their own data" when the author never received their explicitly requested location/device/wireless history (which FB definitely has)?
Does the GDPR only apply to publicly available data? I was under the impression the company was obligated to give the user everything, public and private.