Not really a shock is it
And this is why (amongst other things) why I tell Dropbox to bugger off when they keep phoning me to tell me how wonderful their product is for business and it's sooo safe for personal data and sooo compliant with the DPA. Except when it isn't.