[sanderjd]

I imagine it is the classic loophole of "ask forgiveness rather than permission", which when talking about corporations becomes "take calculated risks based on the likelihood of having a suit brought against you, the probability you would lose such a suit, and the cost if you do". For a big company like Disney, mistreating a department of IT workers is very unlikely to be costly.

On the other hand, it does seem like there should be a regulatory body taking action on this sort of abuse, and I'm curious if anyone knows more about that.