Amongst other things, I'm an irregular blood donor. Though I think they must have an out of date address as I've yet to get my own version of the letter telling me they lost all my details.
I've played around with large data sets from time to time in the line of work and if you were doing involving altering the format of the data presentation or storage you don't actually need access to all the existing records all of the time. So, it is highly likely that it was completely unnecessary to give all 170,000 records over to the person doing whatever work was being done in New York. You could just have taken the records of just 170 people*, blown the entries up 170,000 by automated replication and then performed whatever work to be done on that. Then when it was finally ready to make the port or transfer or whatever the changes were, get the person to come over, do it and send them back. All without putting such a large in the Irish context data set at risk. There again look at the care the BTS took with people's actual lives and should we really be surprised?
* Why not say 170 people who worked or had worked for the Blood Transfusion service?