Why such controversy over prank?

[Tiberius]

Asking a data holder for sensitive information IS asking them to break the act.
You don't have to name it.

No, asking a data holder for sensitive information is exactly that, and nothing more. By giving out that information, they would be breaking the act, but the actual act of asking for it is not the same as asking them to break the act itself.

In other words, there is a difference between:

"Please can I have <insert information>?"

and

"Please break the Data Protection Act and give me <insert information>."

I highly doubt the Australian DJs were even aware of the DPA. You cannot ask someone to break something you know nothing about.

Well not now anyway.

The hospital said they weren't disciplining the nurses before the suicide happened.

But it is ludicrous to hold two men utterly responsible when:
1) Someone else broke the law
2) Someone managed the two men (and thus hold responsibility)

FYI, it was a man and a woman.

What will is a good review of policy, and making sure that staff know not to make massive assumptions about who is on the other end of the phone. That, and making sure that when someone does screw up, they are properly looked after.

This is not being said or iterated over enough here.

I do a bit of social engineering at work. I know the importance of policy, and enforcing that policy.