Both these cases happened because of the operators' ignorance of the provisions of the Data Protection Act- and probably a lack of common sense in not questioning further.