>>chrono+(OP)
I wonder if they allow opting-out. My last company was in the healthcare space, and we used Zoom for all internal communication. Often this could contain sensitive information (PII etc) which would likely be a privacy violation if exposed.
They basically claim that the customer (the one who signs the contract, not the Zoom user) who hosts the meeting is responsible for GDPR compliance by defining the right account settings. So if you are invited on a call you basically have no rights.