

They’re headquartered in the US. GDPR being an EU statute, won’t hold much weight with the current administration; and since they’re filing for bankruptcy the data will be sold to the highest bidder. Likely as not they were selling access to their db when they were in operation.
HIPAA may have a claim on the data that could give some privacy protections, however since people’s insurance wasn’t involved and the process didn’t go through a doctor’s office I doubt it.
https://en.m.wikipedia.org/wiki/23andMe
https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html#who
Member states already have mutual defense pacts that overrule any competing EU dictates in time of war.
https://en.m.wikipedia.org/wiki/Common_Security_and_Defence_Policy
So Hungary can veto whatever they want, but defensive actions will be taken regardless.