It depends. For that to be on the radar, in most countries you have to contact Samsung and come to a solution with them (or try to) first. Then you have to argu

It depends. For that to be on the radar, in most countries you have to contact Samsung and come to a solution with them (or try to) first. Then you have to argue with them about whether or not their anonymisation (which they will surely claim to do) is sufficient. Then when you forward the request to the gdpr institution of your country, you must make reasonable for them why you feel that your request for them to fix it has not been honoured. Naturally this is a process most people do not feel like going through, and as such most companies continue flying under the radar :)