Construction companies breaching the Data Protection Act?