Dr. Fred Logue:

I cannot answer that question off the top of my head, but the basic principle is that there would have to be a legal basis for them, and not just in legislation. There may be some other basis under the GDPR for them to process that information.