oh, and some of this data was unlawfully obtained ...
a few years ago, I bought a £4 memory module in CeX for *cash*.
It was misdescribed (as the receipt showed) so a refund was in order.
CeX insisted on a proof of ID before refunding - even though they had no standing to.
I was left in a catch-22 situation that I *could* have taken them to court for the refund. But not without revealing my identity.
Sometimes, having rights is meaningless - something we should all bear in mind.