Although what you say makes sense, which is the respective GDPR rule? I don’t recall seeing something like this.