If your boss wants you to write a piece of code that collects data/ tracks user behaviour but is not compliant with the latest GDPR rules, can the software engineering employee get into trouble? The employee is just doing what his/her boss is telling him/her to do. I read in some places that employees are also liable for GDPR infrigement.

I raised the point that we need to do a few more things in order to be GDPR compliant. However, my boss shrugged it off and continued with this mini-project that involves data collection. I'm afraid if I raise this point again, I will detroy my relationship with my manager and end up risking my job.