From the article, CA got 270,000 people to install an app. They then used those people to find and download the data for 50,000,000 from those 270,000 users without asking the permission of those 50,000,000.