@neil_neilzone NAL, but IIRC GDPR says something is PII if it can be put together with a second source to identify someone (which is why IP's are PII) *and* specifically calls out Location data. So, the answer to that should be "Yes" as the data's it's been sent to the wrong place/person.