What I do know is: - The Data Protection Act is grossly misunderstood in the UK. - You are obliged to provide what you have on record when requested by it is owner. - You can be penalized for having inaccurate data / failing to provide it on request in a timely manner and not taking reasonable precautions to protect it. - You can not give that data to any third party other than a government official