Comment by Symbiote

The source is this statement from the ICO (Information Commissioner's Office, who enforce data privacy rules, GDPR etc).

https://ico.org.uk/about-the-ico/media-centre/news-and-blogs...