Not stolen, but quite probably violated several laws in connection with privacy and personality rights. And this is already the case in many EU countries, no GD

Not stolen, but quite probably violated several laws in connection with privacy and personality rights. And this is already the case in many EU countries, no GDPR needed for that. I actually hadn't considered it before, but I imagine that being a PI in e.g. Germany must be a veritable legal minefield.