One of the good things about GDPR is, when you give data away, you're responsible to make sure and control it's not misused. You can't blame the party which you gave the data to.