Pondering the @hf.co kerfuffle and, further to my suggestion to @tupped.bsky.social that people should add an Article 18 request into any correspondence with HF, I also think it might be worth invoking Article 19 as well - requiring disclosure of 3rd parties to whom data was disclosed.