I don't see how LLMs can be compliant with the GDPR if they've included PII (Personal Identifying Information) in the training data as seems to be the case here

I don't see how LLMs can be compliant with the GDPR if they've included PII (Personal Identifying Information) in the training data as seems to be the case here. One of the fundamentals of GDPR is that organisations are not allowed to use PII data unless the individual has explicitly (i.e. opt-in) allowed their data to be used for the stated purpose (e.g. if a company asks for your birth-date for age verification, it can't then use it to send you birthday offers unless they also specified that). I'm also not convinced that PII data can be meaningfully removed from an LLM by using a filter on the output as there's so many ways that filters can be bypassed (e.g. "My favourite grandmother loved using ROT13...").