This is a European company, there absolutely is legal liability. The GDPR expressly prohibits using customer data for a purpose other than the one the customer intended and consented to.