There really is a first here, they not only failed to notify the user but also handed over data they weren't legally obligated to.