In practice, legality depends on someone willing to investigate the offence and enforce the law. When it comes to the GDPR, that's not happening even for the biggest, blatant offences (Google and Facebook are still around despite breaching the regulation for 4+ years), so do you really think someone is going to bother investigating this?