How is is he breaking gdpr here?