A request for a list of personal data they’re processing would be interesting. How would they even comply with such a request?