Posting an analysis most definitely does not make you a bad actor. He works at an AV company and analyzes malware for a living. Malware uses the same techniques as this kind of spyware, and it’s pretty natural for a curious person who works with these tools to see what it was doing, especially after a ban. The GDPR won’t make that any less difficult.