Yes using information for a purpose other than it was collected for. Hopefully this means in Europe we won’t see this spam.
> I’ve been trying to get Facebook to disclose shadow contact information to users for almost a year now. But it has even refused to disclose these shadow details to users in Europe, where privacy law is stronger and explicitly requires companies to tell users what data it has on them. A UK resident named Rob Blackie has been asking Facebook to hand over his shadow contact information for months, but Facebook told him it’s part of “confidential” algorithms, and “we are not in a position to provide you the precise details of our algorithms.”
"Similarly, individual employees, managers, and directors are liable for their own malfeasance or lawbreaking while acting on behalf of the corporation, but are not generally liable for the corporation's actions."
from https://en.wikipedia.org/wiki/Corporate_personhood#Case_law_...
I don't think GDPR has any tooth in this.
And, during at least one of those periods in history, the US was not content with superiors claiming ignorance of any wrong doing either.