They will get clobbered by the ICO as it's clear this was neither informed consent nor was the data retention period reasonable. Burying terms of such signific

They will get clobbered by the ICO as it's clear this was neither informed consent nor was the data retention period reasonable. Burying terms of such significance results in unenforceable agreements, so it's naive (but not unexpected) of Cignpost to come out saying they are in full compliance with data protection laws. I would urge anyone potentially impacted to write to the ICO to register their concerns.