GDPR is not about PII, it’s about “personal data” which is a much broader category. It being a public forum is irrelevant, the GDPR’s “right to be forgotten” articles would still apply.
The more relevant response to a GDPR complaint would be that Tom does not do business in the EU.