It's not clear to me how much, if any, of the work was done in the United Kingdom or by British companies.
If the are companies in the UK, or people working in the UK, the sharing or retention of data may have been illegal under British law.
If the are companies in the UK, or people working in the UK, the sharing or retention of data may have been illegal under British law.