Totally same thing when you are thinking GDPR.
Still: Discourse is not expoiting personal data to SSO. SSO is serving that data to Discourse. And what you see at Discourse is needed. It is not regulated data in EU, and I’m totally sure it is not regulated in Turkey either.