4/3) And it gets better. Only one of the two email address fields are masked (so “for security and GDPR” is therefore bollox both technically and legally)

And the browser form, when you click on either of the email address fields, shows the email addresses of other people who have previously filled out that form as helpful prompts. Which actually is a #GDPR and #InfoSec issue.