The Data Protection Act 1998 would presumably apply in the UK and Ireland, and the EU has a data protection directive. My expectation would be that they could not disclose everything without consequence.