They're a Norwegian company, not European. They are based in Europe, and it's likely their engineers will do whatever they're told to do, or face dismissal.
That isn't how it works. How long have you been in Scotland? You do know that if you where an engineer anywhere in Europe that if you were dismissed for refusing to break the law that would be akin to winning the lottery.
Nope, well before GDPR. Have a wee nose at Transatlantic Data Privacy and similar. Hosting a customer database in the USA for a EU website is a-ok because there are agreements in place, you can't do the same in a country where there is no agreement in place and can't export that data to such an external country.Quoted from you previously, this is almost entirely legislated through the GDPR.