Not stolen, but quite probably violated several laws in connection with privacy and personality rights. And this is already the case in many EU countries, no GDPR needed for that.

I actually hadn't considered it before, but I imagine that being a PI in e.g. Germany must be a veritable legal minefield.