This is a perfect example of why EU implemented GDPR. We can't trust companies to protect their users. Once money is involved, the outcome often depends on a few conscientious employees with the strength to say "NO"

Som may say that