They won't switch FFP, as that will be noticed by the passengers later on. What they rely on is passengers with no FFP and don't care. You noticed because you removed the CX one.. (which is rare)

GDPR is not to be trifled with by an EU company. I would definitely raise that with AY. DOB is protected data under the regulation. And CX, as it could well have been CX related staff that created the AY profile (on line)