Need I remind you that the GDPR has an exemption for criminal prosecution?
> Processing shall be lawful only if and to the extent that at least one of the following applies:
> ...
> processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;