FSFE should report them to the GDPR authority, but also financial ones.

The article says Nexi reached out after ‘cancelling’ the contract - meaning FSFE was financially offline for those few days. If it were a ‘normal’ business this was done to, they would sue for damages to hell and back.

And so should FSFE.