Such a search engine that is deliberately created for the purpose of collecting open source information about security related incidents including data breaches and including a link to the source that has a chance of containing the actual leaked information, can be even operated legally for example in the EU under the law of GDPR? What is the legal difference between Google indexing pages that contain such a sensitive information and a search engine that was created for this exact purpose?