Seconded. Most general advice ("IANYL/TINLA") I've heard from lawyers in Germany about e.g. GDPR boiled down to "1. Don't. 2. If in doubt, see 1." -- it's their job to recommend against taking any risks even if the risks are sometimes necessary. It's your job as a business to assess whether that risk is still worth it.