[br1brown]

yes ok, for the law though there had to be my assent communicated by active action because I could decide that I don't want it to be used for the purposes listed in that article and consequently not get the account

I still don't find the guarantor's request unimpeachable

[revelio]

They say they do the verification for "security reasons", which is a lawful basis and accepted justification under GDPR (it helps them control abuse and make bans stickier). You assented to it when you signed up.