When you try to make an online payment from an HSBC bank account, they may ask you to type an email address. If you read the accompanying text carefully, it says they don't actually need an email address; they just want you to type something, so they can collect *biometric behavioural data* (typing cadence), which they send to a company called Callsign, based in Abu Dhabi. I'm astonished this is legal under the GDPR.