does this violate GDPR?
Maybe...in a world where lawmakers didn't put huge exemptions into GDPR for governments and law enforcement etc. Which they did.