Reply to post:

"The answer is simple: the organization has more money than sense."

A few GDPR-max fines will correct that ratio. Meanwhile I suppose their lawyers are assisting them on a slightly smaller scale.