The current data removal policy is pretty straight forward and doesn’t leave a lot of room for interpretation. Basically if info about you can be found somewhere else it’s considered public knowledge and won’t be removed.
But what if the info is no longer available anywhere else and by displaying it we could do harm to the person?
Imagine you were born with a biological sex that doesn’t match the gender you identify with. You came out and your parents and most friends didn’t support you. You were harassed at school and when you grew up and started your transition your parents disowned you. You left the country, legally changed your gender status and name and completely cut off almost everybody you knew before.
You are traumatized and don’t have it in you to keep fighting ignorant people so you don’t want to live your live as a transperson, but instead just want to be considered a man or woman by everybody else. And this works except for the fact that back in the days you and some of the people you are still friends with formed a band and self-released an album on bandcamp. The bandcamp page originally stated your birth name, but you changed it a while ago. Only MusicBrainz still stores your old name as an alias and artist credit of your new name because the GDPR doesn’t require them to delete it.
One day one of your work colleagues stumbles upon your band on MusicBrainz and finds out you are trans.
Now the harassment starts again…
The story doesn’t even have to be that drastic. I think we generally shouldn’t be outing anyone with info that is no longer publicly available anywhere else.