That's a catch 22, I mean they literally are using the contractor... So yeah, they're effectively doing it.

The point was that they shouldn't use contractors and keep their citizens data private. Whenever they don't do that... that's an issue. Hence the critique.

That was the norm for some time, it's just being eroded over the years and is basically entirely gone at this point

Not just in the UK for that matter...