So it wasn't a hack then. The permissions in the app gave them the right to do it, however immoral that was. CA acted immorally but not illegally - until they kept the data after saying it was deleted. Everything else you say is agreeing with me
I was a little disappointed to be honest. Firstly, the title is misleading as there was no hack - CA misused the data that they had permission to gather (though they should have deleted it). The documentary then focused on how the right wing took advantage, but actually they didn’t do anything...