This might fall under the GDPR, at which point they'd get between 2 and 4% of their annual turnover in fines.