i know at least one eu country which ruled processing PII this way is not permitted without consent.