Technically they could - if they had the skills (a restaurant with programmer staff?), had a the reason (risking to alienate the customers?) and had the guts to go against GDPR (somebody will spill the beans). So...