Funnily enough, I work in technology in Europe and have consulted on GDPR compliance. Organisations either care a lot of about their data obligations and have

Funnily enough, I work in technology in Europe and have consulted on GDPR compliance. Organisations either care a lot of about their data obligations and have dedicated teams and reviews, or simply don't care, and don't want that cost passed on to them. And service providers, not wanting to lose a sale, just go ahead with whatever is easier. In this case, they shot themselves in the foot by not conducting due diligence for what would have been a fairly easy to recognise issue. (or worse, were advised, and that advise was incorrect. But based on what I can translate in the original document, that is may not have been the case.)