Obligatory Disclaimer: Not a lawyer, and not an expert in GDPR law and regulations.
I got curious about this and did some digging. There are certain exemptions to the right to access in specific member states. For the argument here I used the UK as the relevant member state because that's where SE's EU liaison is located.
The analysis here cited is from the Information Comissioner's Office.
No general exemption for trade secrets.
Generally, there are no exemptions for the GDPR Article 15 "Right to Access". That means, absent specific other exemptions in national law, every single bit of personal data (meaning: data related to the account) would have to be disclosed, even if the disclosure of such data would prejudice or reveal trade secrets of the data controller. The European Trade Secrets Directive (2016/943/EU) specifically does not make an allowance to use it to prejudice data access requests.
Annotations that contain PI of other users
On a case-by-case basis, the Data Protection Act of 2018 provides a specific exemption for personal data that contains personal data or the identities of other data subject.
In this case that would probably apply to annotations that reference another user, such as "Magisch has conspired with TotallyNotMagisch to promote the MagischWeb Service across their answers".
For such annotations, disclosure could probably be refused on a case-by-case basis based on the right to privacy of the other person.
Is it even PI?
This is an interesting one, because from a plain reading of the law, obviously annotations specifically about a user would amount to personal information about that user. However, a recent ECJ decision has made that distinction less clear cut. Recently, in YS, M, and S v Minister for Immigratie, Integratie en Asiel the court held that the results of an agent processing a person's data (a form with recommendations and legal analysis concerning someone's application for residency in the netherlands) was not strictly speaking personal data and did not have to be disclosed as part of a Right to Access Request.
I don't pretend to understand the full context and preliminary decision here, but it seems to me that the question of how much of the results of PI processing is itself PI is still not exhaustively decided in litigation and thus not set in stone. I wouldn't be surprised if further exemptions are carved from the definition for similar situations.
Broad Language and infringing on the rights of others
Article 15. 4) states:
The right to obtain a copy referred to in paragraph 3 shall not
adversely affect the rights and freedoms of others.
I have no idea how that affects what I wrote above, and couldn't find any court decisions or challenges from that angle, but I would infer from this that in specific situations where a request is made in obviously bad faith with intent to damage or harass moderators making the annotation or moderators in general, this could be invoked to deny specific parts or whole annotations from disclosure on a case-by-case basis.
Further, it would probably be possible to argue that revealing specific annotations could negatively impact and damage the governance of stack exchange and the volunteer work of its moderators.
I'm not sure how far that goes and again haven't found any legal analysis pertaining to it but it seems like something to consider at the end.