Personal data processed by an individual only for the purposes of that individual's personal, family or household affairs (including recreational purposes) are exempt from the data protection principles and the provisions of Parts II and III.
b) (Depending on jurisdiction) they're not allowed to hold, use, disseminate or otherwise do anything with those email addresses without the permission of the account owners, which they don't have. So on what legal basis are they asking for it and can I sue them?
They are holding the data based on your express consent for them to hold the data (hence the requirement for you to press "YES").
Even if the HP were to be holding your data illegally, it is rare for you to be able to extract civil penalties. Normally this is because they are holding data against you that is held illegally (e.g. was hacked), is inaccurate or being used for defamatory purposes (e.g. your photo is being used to advertise adult services).