The Data Protection Act in the UK has lots of rules about the way data is used and controlled. The Information Commissioner's Office is responsible for policing the Data Protection Act and has imposed substantial fines on organisations who have lost data. More info here. http://shredsec.com/local-councils-fined-for-...