GDPR is great and all, but it only takes one rogue employee. I speak as someone who had their data sold by a rogue Aviva employee to scammers all over the world. Which made my life hell for several years.