[HelloNurse]

I'm afraid that the question answered by all that "legal review" is "what can we get away with", not "what is legal", and that that was the principle that informed your GDPR not-quite-compliance big initiative.