but it may be violation of licenses

They excluded code with non-permissive licenses apparently:

Each file is labelled permissive (at least one permissive license detected, no conflicting non-permissive license), no_license (no licenses detected, or only non-license legal texts such as CLAs), or non_permissive. The permissive allowlist follows the Blue Oak Council list plus licenses categorized as Permissive or Public Domain by ScanCode. Files classified as non_permissive are excluded from both released datasets.

also, if it has personal information on it, that’s probably illegal under the GDPR.

It's all public so I would be extremely surprised if that were the case.