INTENT is the keyword for most laws. If the intent here was to check the security it is 100% legal within EU. Don't know about UK. I guess the guy poked around.
I've read current government had some plans to fix it, but they have a lot to do at the moment.