Good points Sam!
(I’m not a legal expert/or staff - so just some thoughts)
I guess with biographical information, the expectation is that has been signed/released for the company/designer of the site to use in marketing/website. The first port of call/responsibility for removing it would likely be the Webflow account holder, or company whose site it appears on.
Copyright - I think that’s more in the realm of intellectual property, than personal data, but those items are likely to be attributed to a ‘person’. Similarly with above, the assumption would be that permission has been given to process and publish that data publicly…and if it needed removing, I imagine the first port of call would again be the Webflow account holder.
One thing for sure, GDPR has raised lots of important questions and added scrutiny about personal data and it’s handling…
In case you’ve not seen these already:
ICO definition of personal data:
https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/what-is-personal-data/
Webflow’s Privacy Policy / Data Guidance
A blog post and some further discussion (not re the CMS, but related issues):