They basically decided they weren't going to pay to secure and maintain the data and since GDPR is coming in to effect it makes such a DB a liability to the company.

In which case the appropriate course of action is to simply delete rather than pay some peanuts and act surprised when the DB ends up in the public sphere. I can only commend them. Too many businesses decide to hold on to private identifiable data as though it were a prize bond waiting to mature.

Exactly. GDPR is around the corner and any private data without explicit consent to be targeted for marketing is going to be useless at best, a liability at worst.

Explicit consent means the company must be able to prove the user consciously agreed to receive marketing. Which is excellent. 1) the burden to prove it lies with the one holding the data and 2) you can't tuck it away in legalese fine print.

I bet a lot of companies are going to do like wheterspoons and just purge the data rather than attempt to make it legit.