Seeing as this is reported by a German organisation about a Swedish company: has this been filed with the authorities under the GDPR? Any details on whether (national) data protection authorities have picked it up and warned the companies and people in violation?