I wonder is Yawn took any personal details from the Primark staff.
I am sure that she obtained the relevant permsissions.
Has a working GDPR document, undertaken her DPA annual training and of course has her annual ICO registration certificte logged.
I do always wonder how these bots seem to fall outside of the handling of personal data remit