What is relevant: “for its own commercial purposes. In that regard, the general terms and conditions of use of that marketplace give Russmedia considerable freedom to exploit the information published on that marketplace.”

This turns the marketplace in a business that must have responsibilities and duty to care because they not only host the content, but process it.

Hosting is defined on paragraph 6. It does not involve processing of information. You user hit publish, it is published without any processing and and you don’t claim right to “use published content, distribute it, transmit it, reproduce it, modify it, translate it, transfer it to partners and remove it at any time, without the need for any ‘valid’ reason for so doing.”.

The GDPR don’t claim you are responsible for merely hosting personal information, but you become responsible by processing it. “The processing of personal data should be designed to serve mankind.”

The point is: you can run a lemmy instance, have people publishing shitposts all day in a hands off moderation policy. One day someone posts a doxxing. As soon you are told, you delete and it’s OK. But you can’t run a business where you invite people to post doxxing information, you claim rights to distribute this information, and them say you are only hosting it, and not processing it.

The problem is the site want the cake (free harbour immunity) and eat it (gain rights to profit from the published content).

Not really. The decision only states that a service that allows to publish advertisements with personal information must review these and make sure it’s they have the consent. Something all “gone wild” subreddits do with volunteers. A company that runs advertisements should be able to.

A company that publishes ads for sexual services without getting confirmation of consent is a risk for the society and this business model should not be allowed.