Theoretically Wikipedia could be held accountable under GDPR already since unbeknownst to many, the website has a despicable procedure where they dox details of anyone whom they deem as alleged vandals.

If the foundation decides to share the details of the involved editors, a large group of contributors could quit their accounts and ask for removal of their contributions.

As seen here and below, the judge reportedly mentioned the word "addresses". Others have said that in this case it could only mean email addresses, home addresses, or IP addresses. The shit has hit the fan.

Actually, the judge opened the sealed cover, perused the contents thoroughly, then asked WMF counsel "How can these addresses be verified?" to which the reply was "These are all we have, and the website does not conduct verification of its users". The ANI counsel assisted his opponent by saying that service on the editors (D2-D4) is complete, they have not appeared, so can we please move on to my defamation takedowns. The judge then resealed the covers. So it can be safely inferred that WMF did not give ANI anything, and ANI never wanted the D2-D4 details at all, it was only a procedural formality so ANI can take on the "Wikimedia method/model" directly which is troubling all their SPAs/IPs. On a procedural note, once the case is complete and judgment given, the sealed covers are opened and anyone can inspect its contents. So nothing to fret over. Storm in a teacup.