That sounds like a slam-dunk GDPR violation case and a hefty fine.