Article 6(1)(e) of the GDPR states that data processing is lawful if it is “necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.”

https://gdpr-info.eu/art-6-gdpr/

I assume they would argue public interest … “protect the children” is the blanket public interest clause that allows all sorts of evil behavior.