This is absolutely true, but it's a function of the business, not the individual engineer. It's not just about engineering at all - one of the biggest GDPR fines was to H&M for some internal data that managers were keeping on some employees.