Every city employee should be doing a subject access request under gdpr to uefa. They will be legally bound to disclose any personal data ( definition on information commission website) and what they have done it and who they have shared it with . No court required for this irs the law. Huge potential fines