A fair number of PLOS One articles have statements like the following:
Data Availability: Data cannot be made publicly available as the dataset contains sensitive and identifying information. The authors confirm that the data will be made available upon request. Requests may be sent to the corresponding author.
My question is, what effect does the EU General Data Protection Regulation (GDPR) that recently came into effect have on such statements? Does it render such statements void (i.e., the authors cannot share the data any longer), or does it not apply to this situation (but perhaps some authors will blindly cite GDPR so as to not share their data)?