I used to contract using Hayes
and they regularly sent out mail shots to every contractor in the company (over 800) that contained the email address and name of every contractor in the "To" field of the email.
I pointed out to them that they had revealed to the 800+ recipients, that I was a contractor, contracting through Hayes and what my personal email address was. This was personal data and they were in contravention of the Data Protection Act in revealing that information.
They took me off the mailing list but, according to other contractors, still used the "To" field when sending mail shots.