Excellent question. I would say that this breaks GDPR principle #2, 'purpose limitation'. See e.g. https://www.cyberpilot.io/cyberpilot-blog/data-protection-pri

Excellent question. I would say that this breaks GDPR principle #2, 'purpose limitation'. See e.g. https://www.cyberpilot.io/cyberpilot-blog/data-protection-principles-the-7-principles-of-gdpr-explained/#:~:text=If%20your%20company%20handles%20personal,Integrity%20and%20Confidentiality%3B%20and%20Accountability https://www.cyberpilot.io/cyberpilot-blog/data-protection-pr....