It does apply but they were allowed to have this data and GDPR does very little to protect it in that case.