None. There is a difference between actually storing personal data and it being possible to forensically analyze data not eligible for protection and potentiall

None. There is a difference between actually storing personal data and it being possible to forensically analyze data not eligible for protection and potentially correlate other similar data that in turn is tagged with metadata. The second party has the obligation not the first. Ultimately all risk of exposure of personal data derives from the second party. For example if you mail in an executable to a client and put some code on github under your own real name the holder of the exe has no obligation because it is impossible for your identity to be exposed by it or indeed an infinite number of similar executables. It is only when combined with your github profile where you willingly shared a work sample and your real info that you could possibly be exposed.