Maybe he has a insta profile with the name of his kids in his bio
Irrelevant. The data being public does not make it up for grabs.
‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’);
They store his personal data without his permission.
also
Information that is inaccurately attributed to a specific individual, be it factually incorrect or information that in reality is related to another individual, is still considered personal data as it relates to that specific individual. If data are inaccurate to the point that no individual can be identified, then the information is not personal data.
Storing it badly, does not make them excempt.
That's a good point, that muddies the waters a bit. Makes it hard to say wether it's spouting info from the web or if it's data from the model.
I can't comment on actual legality in this case, but I feel handling personal data like this, even from the open web, in a context where hallucinations are an overwhelming possibility, is still morally wrong. I don't know the GDPR well enough to say wether it covers temporary information like this, but I kinda hope it does.