It would be fine if they only gave whitelist access to people who could already simply access your data by request. But GDPR would only require that they know w

It would be fine if they only gave whitelist access to people who could already simply access your data by request. But GDPR would only require that they know who could access, and that the access list be less than "the entire world".