It would be, but the question is whether the law is being enforced?

As far as I know, you can't directly sue over a breach of the GDPR, and the regulators who are supposed to enforce it on your behalf are unwilling to do so.