Someone should have to investigate, but I suppose it's all "legal"?
In EU law it is very likely against GDPR.
Someone should have to investigate, but I suppose it's all "legal"?