Aug 64 min readImpersonation is not investigation: why GDPR compliance matters when you instruct someone to gather information