Twitter is the data controller. They have to be GDPR compliant. Moved the problem from me to them.