The Data Protection Act may make it illegal (*may* - I'm not sure there isn't some loophole) but making it illegal != preventing it from happening. It just means they have to stop if they are found guilty in a court of law. And legal battles can be time-consuming and expensive.