I wouldn't read too much on the comment that they don't already comply with GDPR. It's likely it only means they would not comply with an Access Request before the effective date (5/25).