Just because something happens in a GDPR region, doesn't mean it is legal. I see GDPR violations everyday.

Indeed that was why I called it out. To stress what shit is happening despite the GDPR. Violations are rampant and enforcement is sparse.

You have the right to file a complaint to a applicable data protection authority.

Data subjects have a right to complain under art.77 to the extent their own data is involved. But I am not a data subject in this case.

I could still complain, but it would not have the force of art.77. It would basically be a request that the DPA voluntarily investigate in an “ex officio” capacity -- on the DPAs own initiative (if they care to do so). I’ve done that before and the DPA simply ignored the complaint. I did not even get an acknowledgement.