In Germany, it breaks TDDDG §25 verbatim, storage of data not explicitly consented to and not technically necessary is already illegal.
So sue them. You will then learn whether you are right or not.
So sue them. You will then learn whether you are right or not.