I was passing by a restaurant the other day. Its registration stand was just outside the entrance. There was a reservation list. The woman in charge was not around. I could see the names and mobile phone numbers of individuals who had made reservations to dine at the restaurant.
The restaurant is obviously oblivious to the data protection law requiring protection of personal data – including no unauthorised access to it and no accidental disclosure of it. It’s likely that it’s oblivious to other requirements of the data protection law too.