Cris is not set up to put data subjects in touch with each other. Just consider how such a service requires considerable management, and Cris may simple do not want the hassle of getting involved with providing it, becasue you only have to look at how the big boys like Facebook and others have had to try and deal with scams, and data breeches all of which costs money to manage.
The DPA requires that any organisation that collects personal and sensitive personal data must define what they use it for, and ensure it is not used for any other purposes. Cris is simply protecting itself from getting involved in any "off focus" communications. If any employee of Cris offered to facilitate EW1999, they would be in breech of the DPA becasue they had accessed and processed data from the companies database outside of the companies DPA scope of approval.