That's the way it's supposed to work. But it doesn't work that way always (unfortunately). Data protection laws doesn't mean that they are not violated on occassion. ..... and the "gender" of the accounts not matching has certainly been caught once by UA when a status match from BA (Gold, if I recall correctly) was underway. Yes, some may "get away with it", but one was also certainly caught -- but without consequence other than not achieving the status match.

In any case, BA won't be needing copies of cards and statements since they generally don't do status matches (at least not these last couple of years). DL would want such copies, but DL's been known to do status matches without copies of either the card or alternatively without copies of the statements.