Comment by s_dev

Before GDPR there actually wasn't much penalty for reckless collection and storage of personal data. Only PR damage had to be considered.