Originally Posted by
niko_cee
It's not a question of data breach, you simply aren't allowed to collate large amounts of personal information, regardless of source, without having a lawful basis to do it and for it to be a proportionate thing to do even if you do think you are on sound ground as regards that, which they won't be. Every aspect of data processing and controlling is heavily regulated, particularly for large corporate entities.
Once you have collected the data, which you probably aren't allowed to do but even if you are, you then become a processor and possibly controller of that information, which imposes all sorts of regulatory requirements on you. The law is ridiculously far-reaching.