Hey @rbole,
In general, see also this thread: GDPR compliant nodes and subnets
AFAIK the replica is like a black box for a node provider, but with some effort a node provider could dump the state of the replica and investigate it.
Technically, I’d argue it is way harder for a node provider to access data than for an AWS employee. However, AWS has signed the required contracts.