Thank you for answering. I assume you are a subject matter expert qualified to interpret the legal documents?

I have actually read some of the resources AND been there whilst customers received advice from lawyers. From what I had understood this model looked dubious.

I have not seen a discussion of this that didn't just end up in talking about morals. Even excluding this I really only wanted input from experts - answers from actual lawyers about GDPR have surprised me compared to what developers had assumed about it...

NB If I had a customer that proposed this model I would still insist that they consulted with their own legal advice before proceeding!