GDPR says it's illegal, but its weight is about the same as the UK law that says it's illegal to handle salmon in suspicious circumstances (https://en.wikipedia.org/wiki/Salmon_Act_1986).

A law is only good if there are actual consequences for breaking it and so far there hasn't been any for these kinds of large-scale breaches.