> I'm not aware of any law before GDPR that permitted this. Normally, you'd have to have a court case and do discovery. Directive 95/46/EC of the European Parl

> I'm not aware of any law before GDPR that permitted this. Normally, you'd have to have a court case and do discovery. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data