This looks like a massive breach of UK #GDPR and the Article 8 right to #privacy. There is no possible way that this can be justified. I hope that complaints have been made to the UK Information Commissioner and that they will be investigated.
@eleanorrees This bit: “All information collated was publicly available and we have not seen any evidence or suggestion that this wasn’t the case. There can be no reasonable expectation of privacy when personal information is being voluntarily put into the public domain by the person to whom that data relates.”
That isn’t how data protection works. It doesn’t matter if the information is public, you still need a lawful basis for processing it.