you original lender has sold your loan if I understand what you are saying. They were the Data Owners. As part of that they obviously had to hand over personal details to the buyer of the loan. Chance are this is perfectly legal. For example, providing an appropriate agreement is in place between the lender and a debt collector, it is perfectly legal for a lender to hand your details over to a collection agency. In the same way, it is quite possible that providing an appropriate data protection agreement is in place between the original lender and the buyer of the loans, then they have both covered themselves