In theory yes, but they can't use the data for legitimate business while also complying with the regulations.