I work in the information security department of a fairly big transportation company. Recently, my team leader added me and my colleague to a WhatsApp group and told us to gather as much as information as possible about a couple of members of the public who criticized the company on a social platform. They want us to gather every information we can find online ("even shoe sizes") and create separate reports for each person that criticized the company.
According to my team leader, this request came from the upper management and we should finish the task quickly. But I feel like this request is unethical and maybe even illegal according to the law. My team leader doesn't come from an information security background, so he doesn't have the technical capabilities to do this himself. Nor has he any ethical problems with the task, it seems to me that he just wants to please upper management.
I have been finding excuses to not do the task, but my team leader is pressuring me to do it. I can't lose my job because economy is really bad here right now. But I also don't want to lose my self-respect or commit a crime.
I am in a dilemma. One part of me says I am overreacting and should just do the task, but another other side of me feels like this is wrong and I should decline this request, no matter the consequences. I believe talking to my team leader about my concerns wouldn't work because he wouldn't listen to me and he would just try to persuade me to do it.
Should I do the work anyways? Should I refuse and report this to HR/someone else?