In the UK we had the Data Protection Act before GDPR, but it was so full of words like "reasonable" and "appropriate" and "balanced" that is was basically homeopathic; I wouldn't be at all surprised if this story was from the UK. I'm so glad GDPR got in before Brexit.