Interesting to see the claims compared to those in the "Nightmare Letter" [1]. The incomplete response to the first letter is interesting. It has been to easy to break responsibilities which are ion place right now. This presumably led to the draconian penalties in the GDPR.
[1]https://news.ycombinator.com/item?id=16606629