They could be using GDPR as an excuse to do this. Or, to be more charitable, their legal people have been reading FUD about the GDPR rather than the actual regulations. GDPR has plenty of provision for legitimate interests, particularly in favour of the data subject: https://www.gdpreu.org/the-regulation/key-concepts/legitimat...