Absolutely (I'm a big fan of the GDPR), and privacy by default is IMHO what might have helped here. But it's hard, and hard to enforce outside of training requirements. People tend to think that aggregate data sharing, like a heat map, is always fine...
♥ 1