But if you look up the laws on data protection there are limits to what you can do legally with data, and especially PII data, generally and also without direct and explicit consent. There's also a section of law about using data in excess of its purpose (can't recall the exact legal term) and...