From what I understand (as mentioned, IANAL) having the database itself is lawful, as they're compiling it to comply with a legal requirement, but under GDPR, t

From what I understand (as mentioned, IANAL) having the database itself is lawful, as they're compiling it to comply with a legal requirement, but under GDPR, that still wouldn't stop from having to comply with GDPR and the rights (including knowing if a subject is in the database): http://lexindicium.com/2018/03/19/data-mining-and-gdpr-compliance/ http://lexindicium.com/2018/03/19/data-mining-and-gdpr-compl... https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens/my-rights/what-are-my-rights_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... Right to: information about the processing of your personal data; obtain access to the personal data held about you; ask for incorrect, inaccurate or incomplete personal data to be corrected; request that personal data be erased when it’s no longer needed or if processing it is unlawful; object to the processing of your personal data for marketing purposes or on grounds relating to your particular situation; request the restriction of the processing of your personal data in specific cases; receive your personal data in a machine-readable format and send it to another controller (‘data portability’); request that decisions based on automated processing concerning you or significantly affecting you and based on your personal data are made by natural persons, not only by computers. You also have the right in this case to express your point of view and to contest the decision. In particular, the clauses about access to personal data and to have decisions being made by a natural person seem relevant here.