And European courts consider intent carefully. Mere aggregation of personal data isn’t necessarily a violation, but using it commercially almost certainly is.