My first thought is that people running Mastodon wouldn't qualify as data controllers, but I am no expert in GDPR laws.