My impression was that the temporary permission-granting regulation was passed before the relevant privacy law came into effect, but I didn't check the dates now.

You could probably have sued them. I'm not aware of any cases where that happened.