Yes, but does GDPR require the delivery format to be practical? Over time, if not happening already, you could probably see companies trying to introduce randomness / changing the format every so often for the sake of blocking this.