1) It was not their main role
2) It was a token gesture, someone to address post too!
Every consulting firm I know is trying to sell GDPR services atm...