When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
Are we assuming personal data includes anything uploaded to the cloud? Like the .svg files? Because that is likely not personal data, at least it’s not all personal data by default.
Personal data is any information that relates to an identified or identifiable living individual (data subject). Different pieces of information, which together can lead to the identification of a particular person, may also be considered personal data.
Source: https://commission.europa.eu/law/law-topic/data-protection/data-protection-explained_en
So I would think what details are associated with one’s account, and what sort of encryption and control of the .SVG files plays a part.
As for what you can do if you think your rights under GDPR haven’t been respected, you can boycott them or file a complaint or file a legal action.
IMO, unless you could show your data specifically was mismanaged and exposed to someone who should not have had it, I would be skeptical of the success of any lawsuit. Obligatory, not a lawyer.
But… Why? Why would some Disney muckety muck buy a ton of live lemmings and shove them off a cliff, and put it in a movie?