In this case it's not the checking of the employees that is the focus of attention (it says the companies using the service were written to and warned), but the building of the database. The employee's details were not allowed to be shared in such a way without their permission, and the company wasn't registered to even create such a database. Certain details (such as records of them reporting safety breaches, union membership etc) would be of debatable legality in any database of that tye.