I mean... It's pretty explicit in gdpr that the "transfer to non-eu servers" part means you can't send it via federation in the first place to non-eu servers unless those servers also adhere to gdpr: https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations/obligations/what-rules-apply-if-my-organisation-transfers-data-outside-eu_en

The answer is that currently federation and Lemmys use of it are not gdpr compliant and the first gdpr case against any Lemmy instance in the eu will force that instance to defederate from all non-eu servers.