The conflict seems to be around why Facebook are so happy to have our data shared with 3rd partiesIsn't it to do with them taking the data of users who have opted in to use the app but also then getting their friends data when their friends haven't decided to lock down their accounts.
Then, CA decided to keep that data after facebook told them to delete it.
GDPR can give companies huge fines, but that doesn't help the people once their data has leaked.