The most recent example was when we wanted to put together a list of all the research staff in a couple of departments with their email addresses and research interests, to help masters students know who to ask to supervise their dissertation.

All of this info except the email addresses was already publicly accessible on the university's website. The email addresses were corporate, not personal, ones. And the whole point of the exercise was to make people contactable for the purpose of doing their job.

We got told we couldn't do this unless we had explicit consent from everybody who would be on the list.