export personal data without user explicit consent is a breach againts GDPR

Let's begin with a checklist: Replace the empty checkboxes [ ] below with checked ones [x] accordingly. -->

• I have searched open and closed issues for duplicates
• I am submitting a bug report for existing functionality that does not work as intended
• I have read https://github.com/signalapp/Signal-Android/wiki/Submitting-useful-bug-reports
• This isn't a feature request or a discussion topic

Bug description

GDPR prohibits collection of personal data without the full, explicit and informed consent of users.

If informed consent is used as the lawful basis for processing, consent must have been explicit for data collected and each purpose data is used for (Article 7; defined in Article 4). Consent must be a specific, freely-given, plainly-worded, and unambiguous affirmation given by the data subject; an online form which has consent options structured as an opt-out selected by default is a violation of the GDPR, as the consent is not unambiguously affirmed by the user. In addition, multiple types of processing may not be "bundled" together into a single affirmation prompt, as this is not specific to each use of data, and the individual permissions are not freely-given. (Recital 32)

Data subjects must be allowed to withdraw this consent at any time, and the process of doing so must not be harder than it was to opt in. (Article 7(3)) A data controller may not refuse service to users who decline consent to processing that is not strictly necessary in order to use the service. (Article 7(4)) Consent for children, defined in the regulation as being less than 16 years old (although with the option for member states to individually make it as low as 13 years old (Article 8(1)),[10] must be given by the child's parent or custodian, and verifiable (Article 8).

The GDPR states also that the data collected is subjected to a right of portability (Article 20). So a data subject must be able to transfer personal data from one electronic processing system to and into another, without being prevented from doing so by the data controller.

As some of your users are european citizen, you have to comply with the GDPR

Actual result: Describe here what happens after you run the steps above (i.e. the buggy behaviour)

Now user are forced to define a PIN code and personal data is then uploaded to signal server without user's consent.
The user is not able to opt-out this personal data collection made by signal.
The user can't access to its data (conversation history, etc.) without defining a PIN code. So the personal data of the user is therefore withdrawn from the user until it has given implicit consent to personal data collection (by entering a PIN code).

This is clearly a violation of the GDPR.

The user don't has either the possibility to easily export his data (conversation history, etc.) to another provider.
It's also a breach of the GDPR.

Expected result:

Signal app and server should comply with the GDPR and thus obtain proper explicit and informed consent of their european users before collecting their personal data. The users must have the possibility to opt-out data collection if they do not consent.

The data collected should also be transferable from signal to another electronic message provider.

Device info

all devices and os

this seem also related to bug #9812 which has not been given proper attention

No source files or tests are named in the issue. Start by tracing the PIN setup, personal-data upload, and data-export entry points, then review the related issue #9812. Done would require a decided, testable scope for consent, opt-out, access, and portability behavior.