Accessing Max Verstappen's passport and PII through FIA bugs

They may have said that process was related to GDPR, but that was either a lie or someone with so little understanding for basic laws that I wonder about their capability to conduct business at all.

Everything about this is prohibited and discouraged under GDPR.

As pointed out, this is unrelated to GDPR.

Many countries in Europe require you to register with the local police any visitors you are hosting and pay a visitor's tax: this is why hotels would ask for the same documents too.

GDPR should help ensure they only keep the passport data until they complete the registration, and then remove it after some time or at your request.

All hotels I stay at in all countries require my passport. OK, not the usa but there they want my driver's license.

You were lied to.