The EU's enforcement of its regulations/directives is severely lacking (see the GDPR for an example) so in practice it doesn't really matter whether it's legal

The EU's enforcement of its regulations/directives is severely lacking (see the GDPR for an example) so in practice it doesn't really matter whether it's legal - the worst that will happen is a slap on the wrist in 5 years' time and if you're lucky, a fine worth a fraction of what the company earned by breaching the regulation.