GDPR/DPA. Essentially if you use data for a purpose it was not originally obtained/intended for then you have a problem. Takes Searchlight out of the equation immediately along with a whole host of things.
