By GDPR this is illegal. But I assume no action will be forthcoming