Yes, basically you're right. However, in the very first section, the legislation describes to whom it applies. You actually have part of the solution in your comment already. If a person wants to have his photo removed, he can sue to have it removed. But who would he sue? Utopian.io as a platform does not store anything about anyone. The blockchain is decentralized and distributed, so you'd have to sue everyone with access to the blockchain. Since there isn't a single entity registering, processing and storing your data, the GDPR doesn't actually apply as there's nobody to be held accountable for breaches and thus, nobody to sue.