Data protection rules do not prevent firms from collecting, recording and sharing customer vulnerability data where it is “appropriate”, a statement from the ...