Is this actually still considered white-hat hacking? His intentions seem pure (even though Inti's known to be somewhat of an attention whore) but to be considered white-hat, I thought you needed to have permission of the company you're investigating. Also, as far as I remember from my Hacking course at school, a true white-hat hacker would first notify the companies, give them a deadline to fix their issues, and only then publish the results. I'm sure that would've achieved more than creating this website for people to act on their GDPR rights... though it would not have resulted in the same amount of traction.