So the engineering manager flags up that there's a major privacy impact, and may also be legal issues (i.e. GDPR).
But, the head bean-counter. Not a lawyer or an engineer, a CFO says it's OK? And despite the responses telling him why he's wrong, they seem to have plowed on with it for a while.
I quite like Gitlab as a product, but I'm becoming quite worried about the direction the company seems to be headed - history is littered with good tools that were badly managed and went to shit.