To add to the approved reply:

The GDPR has some other requirements to it, such as an EU-based representative being necessary for operating in the EU, allowing users to request data updates, and getting consent for data collected

You could make the argument that the mall Santas aren't authorized representatives of real Santa, as they are hired by malls with no supervision from the North Pole administration. Thankfully this doesn't matter, because Santa himself is a resident of Finland, an EU country, which is also where his business is located. Chistmas is saved, everyone.