We are about to send our DS to a pre-prep and I was going through school's T&C's that we are to sign and came across this section: "we can notify other educational institutions of your outstanding payments"... I am not planning to default in any way but I thought that sharing this sort of data with third parties is in breach of GDPR...? I am not a lawyer, hence my question is of pure ignorance, but how can something like this be packed into a standard contract...? Is this normal? What am I missing here?