And a lot of money to a lawyer who will sue the ISP under privacy laws if it comes to light.
It has to be clearly stated in the signed contract that your data will be shared with third parties, in what way and how they will be processed. The company involved would definitely lose any Privacy Shield provisions for the EU and potentially peering rights.
Losing enough peering is identical to being disconnected.
Class suit of this kind is easy.