It does feel concerning - but their DPO should be able to answer any questions. There is no way their Monitoring Officer will be prepared to breach data protection rules with so many people interested.