[popper]

and if you can find the time, the rules that need to be followed for that Privacy Impact Assessment (PIA) is here
http://www.ico.gov.uk/upload/documen...l/1-intro.html

did they follow all the provisions ?

i wonder

http://www.ico.gov.uk/upload/documen...preparing.html

"...
2. Undertake a stakeholder analysis

Those who may see themselves as 'having a stake' in the project should be identified at an early stage. This may include:

• the organisation conducting the project, and perhaps also various sub-organisations within it;
• other organisations directly involved in the project;
• organisations and individuals that are intended to benefit from it;
• organisations and individuals that may be affected by it, and possibly
• organisations that provide technology and services to enable it

It is advisable to document the results of the stakeholder analysis in an appropriate form, most likely a one-page summary.
...
"