After a data breach, a custodial cryptocurrency wallet site forced me to log in to change my password. I assumed it was a test account with no value inside, but

After a data breach, a custodial cryptocurrency wallet site forced me to log in to change my password. I assumed it was a test account with no value inside, but wasn't sure. Upon login, they didn't let me access my account, asking me to fill in a KYC form with a lot of personal data. The form was empty, but I didn't know what data they had anyways, certainly wasn't going to give them more data, but couldn't see the wallet balances. So I sent them a GDPR request, and they told me exactly what data they had and which data they didn't have (confirming that it was next to nothing, and thus that I didn't have to worry about the breach too much). They also confirmed which wallets are in the account (allowing me to confirm that they were empty, as expected, thus giving me no reason to fill ou the KYC). Without GDPR, I'd be faced between the choice of giving them more data, or not being able to confirm that the wallet is empty (thus potentially losing out on cryptocurrency that I had forgotten about). In the end, I'd have probably provided the information, potentially exposing it when they will inevitably have the next breach. Before that, Germany already had GDPR-style laws. I get very little spam, because people don't sell my address. I think there was one case where my address was passed along - I demanded to be told who passed it along, deleted, and the deletion request be passed on too, and the spam stopped. Doesn't work for completely fly-by-night companies and proper spammers, but does work for the ones who try to stay on the shady-but-not-illegal side (losing one address doesn't matter to them, and is certainly not worth the trouble of not complying with the deletion request). I'm literally not using a spam filter.