This might have been downvoted because it seems the user in the US, and the company is also in the US. GDPR doesn't seem to apply here. Or maybe you were being sarcastic by saying "state data protection authority", but it's not obvious enough.