Would you say every company that owns a phone book has to serve such an Article 14 notice to everyone who is in the phone book? If you, as employee of a company, visit a company website for some quick information, and that website happens to include personal data, would you be forced to write that Article 14 notice, or delete your browser history, or both?
The company would probably be able to claim that it would involve "disproportionate effort" to serve an article 14 notice to everyone in the telephone book - but this would be the only basis on which it would not have to do so. The employee would be a processor and not a controller, and so be not personally required to serve the notice. I am not sure how this is relevant, however.
The difference I wanted to highlight is that as a user of a service, you only give data away, and recieve data that was given by the data subject willingly and for that very purpose, who were informed about all the implications as required by the GDPR. While not as public as a phone book, it's as public as a companies deed (=anyone who pays a fee can get it), hence comparable.
But that would mean if I created my own Facebook alternative as a private individual, no matter how large it would grow, as long as I would keep it as a garage project I could own millions of users data all while the GDPR wouldn't apply to me... Yeah, I'm sure that protects user data alright...
The extent of the data processed does not appear relevant to the "personal or household[/family]" exception. The example that you give is an edge case which was no doubt not in the minds of those who drew the Regulation.
(As an aside, there may well be a case for replacing things like Facebook (by competition, not force) with decentralised services, run by the people who use them on servers that each rent as part of their ISP package, bringing the original idea of the World Wide Web up to date with modern networking technology: in that instance, each individual would run an automated server that would host her/his own data and interact with all the other servers, which would form a cloud from which social networking and other currently centralised services, such as auctions, online dating, advertising houses for sale/rent, ride sharing and other such things could be provided in a decentralised manner. In that way, each individual (at least in the non-commercial cases) would be acting in a purely personal capacity and be exempt from the GDPR, as well as from the control of large organisations).
I am afraid that it is very naive to think that the GDPR is a way of the state protecting people from the actions of commercial entities. It is an example of the long-standing technique of myriad tyrants of taking a genuine issue and deliberately over-reacting with far more extreme repression of liberty than can possibly be justified in truth to solve the original problem in order to achieve sinister and repressive ends. Remember, the state is the institution with the most power, and there are huge exceptions for the state (e.g. anything to do with "national security", which is not clearly defined) in its compliance with the Regulation. Be in no doubt that the people who drew, sponsored and passed this legislation are deeply, deeply evil.
