@bruces I can't see any breach of article 5 of the GDPR....

Data is collected in a transparent manner, for specific, explicit and legitimate purpose, not further processed, limited to what is necessary, kept up to date, permits identification no longer than needed, processed so that security of personal data is guaranteed...

After all, all we know (no one has ever seen The List) the list contains "name => nice|naughty", it'S needed to fulfil their task ... 🤷 Sounds legit...