I imagine some PM and engineering team on the marketing product realized that the phone number was available in the user's database entry, and so... why not exp

I imagine some PM and engineering team on the marketing product realized that the phone number was available in the user's database entry, and so... why not expose it indirectly for marketing? It'll make a ton of money! This is exactly why I am a huge fan of the "privacy by design" parts of GDPR and the fact that the regulation places a heavy emphasis on how the data is used in addition to who sees it. It has helped to crystallize the discussion about privacy as not just "what data" but "data + usage". I like that engineers are increasingly required to think about not just what the data is but also how it's being used. When the act of connecting data sources has ethical impact, engineers can't be agnostic.