They may have said that process was related to GDPR, but that was either a lie or someone with so little understanding for basic laws that I wonder about their capability to conduct business at all.

Everything about this is prohibited and discouraged under GDPR.