She can still say "I didn't sign anything, prove it", because she didn't sign anything, and thus they can't prove it.
Someone reading your personal information from something you throw away is your problem, if you're careless enough to do so, but to actually remove her form from the garbage and sign her up for the VISA card without her permission is illegal enough, let alone actually going through the process of selling her personal information as they would have done if she had agreed to it...
They actually announced the discovery on the 28th February - 2nd April was simply the date of the first paper they published about it. See this BBC News story from 27th Feb.
She can still say "I didn't sign anything, prove it", because she didn't sign anything, and thus they can't prove it.
Someone reading your personal information from something you throw away is your problem, if you're careless enough to do so, but to actually remove her form from the garbage and sign her up for the VISA card without her permission is illegal enough, let alone actually going through the process of selling her personal information as they would have done if she had agreed to it...
They actually announced the discovery on the 28th February - 2nd April was simply the date of the first paper they published about it. See this BBC News story from 27th Feb.