So, yes, their PCN is ridiculous with no photographic evidence at all. We spend our time laughing at the PPCs but the Chuckle Brothers truly are the stupidest of the stupidest. My impression is that they have a background in other sectors of business and just latched onto the PPC scam as a way to make easy money, without having a clue what they're doing.
The only thing that worries me is that if your brother did sue for GDPR distress, it could go wrong if the fleecers do have photographic evidence salted away somewhere which they could dig out, and he could lose the case and have to pay their costs.
Also, what is likely to happen in practise is one of two things.
SCENARIO 1 The buffoons ignore a claim form as they don't understand it and your brother wins by default.
SCENARIO 2 The imbeciles panic and run to Gladstones solicitors, who file a ludicrous defence in order to spin the case out and rip off, hopefully your brother, but certainly their own client. We've seen this happen.
In any case, don't do anything immediate. I think a little discussion with the other regulars over the next 48 hours would be a good idea.