I think we can assume most non bs laws should allow legitimate good deeds
He may have good intentions, but if Santa gets hacked, that could ruin your life.
According to https://www.noradsanta.org/en/sleighinformation, Santa travels at a speed faster than starlight.
If you were in the South Pole, it would take Santa less than a tenth of a second to reach you
Are you sure you want to hack someone that knows everything you did bad, can reach you anywhere you are on earth in less than a tenth of a second and can break into billions of houses in a single night without anyone noticing him?
I mean, what's he going to do? Give me a lump of coal? Evidently, the guy isn't using his superpowers effectively to combat crimes.
Besides, it's not like modern hacking specifically targets people. If the guy is running Apache HTTP server v0.7, because that was state-of-the-art in 343 A.D., then you'd have to actively exclude Santa's IP range, lest your automatic vulnerability scanning will have him hacked without you even knowing about it.
You are allowed to store info that is required to provide your service as long as the customer is aware of it.
People just don't understand the law tbh.