I don’t know much about this particular case, but speaking as someone who has experienced serious lapses of data protection in the UK university sector, there needs to be stronger enforcement of data protection laws, as the universities just don’t care. They make a huge fuss about privacy to students, but will just randomly hand out PII without a second thought. I’ve personally seen spreadsheets of people’s enrolment and disability status sent to entire mailing lists by mistake, egregiously violating data protection law. I’ve actually called the ICO before when I realised that literally hundreds of high privilege SU accounts had the same password (these accounts were used to handle expense claims for thousands of students, and had years of bank records). There was no enforcement action as far as I’m aware.

I doubt that the administrators who provided this information to the Met even thought about the students rights for a second.