It's exactly the same GDPR that every country in the EU has. That recruitment practice sounds like it could be a breach, I would go ahead and submit a SAR just to put the frighteners on them to be honest.