For my non-European readers, here is an excerpt of what the GDPR means: (emphasis mine)
The General Data Protection Regulation (GDPR) is a regulation in EU law on data protection and privacy for all
“processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”
Case closed.