@refalo citation needed. you can do a lot under data protection law as long as it is expected by the parties to whom the data relates and doesn’t go beyond it.