Gdpr means data out of my control is someone else's liability. If they want to play fast and loose, that's their look out.