Not true. There are some countries where it works like this, but also countries where it's the opposite. In some EU countries this got ruled as unconstitutional. In some other countries, this got ruled by the highest court of law as unlawful.
> This is a corporate regulation, not a criminal case.
That doesn't matter in most EU countries.
Until you prove otherwise, by means of contract, legitimate business interest, law or consent, assume private data is meant to remain private.
