Wow, how much would it cost to prep and send one of these fake Ledgers? This takes a lot more up front investment than a 419 email scam.
The European data retention law certainly wouldn't apply if their backends aren't actually receiving this data..
However that might well be that of a third party, or their own but without any unique/linkable identifier being transmitted with the requests.
Certainly these endpoint have no authentication / user accounts though, and I don't think it'd be easy for some low level hacker to associate an IP address with a specific person.
The current ones don't seem to require creating an account/linking to the profile used for ordering the device, so a targeted attack as described in my parent post does not seem possible, but I don't know if it's always been like that.