I think this is one of the areas that is a little grey and until case law makes it clear there will be two schools of thought on this. Speaking totally personally, I am inclined to agree with you - after all the user is only getting something that has already been shared with them. However the current college policy is that this has to be redacted - has been since before we were talking of GDPR.
Time will tell if this policy changes - but I suspect that even if they decide to no longer redact content like this they will still want to check through it before releasing the data.
Like many here, policy is outside of my control and I just have to try and implement it as best I can. Having the options you discuss will help give us the flexibility we need whatever the outcome - so this sounds very positive
Tim Gildersleeve, VLE Manager, Bradford College.