Comment by dijksterhuis

GDPR allows for this as far as i can tell (IANAL)

> Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:

> ...

> for the establishment, exercise or defence of legal claims.

https://gdpr-info.eu/art-17-gdpr/