Even if this counted as processing of personal data (questionable), it would almost certainly be lawful under the "processing is necessary for compliance with a

Even if this counted as processing of personal data (questionable), it would almost certainly be lawful under the "processing is necessary for compliance with a legal obligation to which the controller is subject" criterion.