This technically justifies GDPR fine. A software leaking and processing PII without permission for this specific use case. But I would not hold my breath.