That sounds like a great example of why you need a GDPR specialized attorney to review everything you do then…or just return status code 451 and call it a day.