As someone who works for the NHS building systems that handle user data this blows my mind. How was "don't give advertisers personal data" or at the very least

As someone who works for the NHS building systems that handle user data this blows my mind. How was "don't give advertisers personal data" or at the very least "don't give advertisers medical data" not top priority!? This is the type of data breach that people should go to jail for.