[KomoD]

> GitHub is a US company that processes data of EU residents. They're subject to GDPR.

You aren't located in the union in any way.

> I've been in cybersecurity since I was 14 — data protection laws aren't new to me.

Great, then you should be familiar with Article 3 of the GDPR:

> This Regulation applies to the processing of personal data of data subjects who are in the Union [...]

> This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union [...]

And Article 20 does actually have several conditions, it's not unconditional.

...

> Additionally, California BPC § 17200 applies since GitHub is California-based.

What does this have to do with "unfair competition"?