“Only have your gas appliance serviced by a CORGI registered engineer”
“Only supply your personal data to an ICO accredited data controller”

Marvellous!

For example, are Nectar/Tesco et al complying with DPA Schedule 1 2.1(1)? This says that personal data must be processed fairly, and that regard must be given to whether information was obtained from a person who was deceived or misled as to the purpose for collecting the information. Are Tesco/Nectar really explaining clearly what they do with cardholders’ personal data? Are they misleading their customers by couching such explanations in small-text marketing lingo that doesn’t really describe what they are actually doing?

I suspect that most people are completely unaware of the scale of the data mining undertaken by these companies. Perhaps data controllers should be obliged to be a bit more forthcoming? Freedom of choice is very important, but is rather meaningless unless an informed choice can be made.

As noted by Becky, the ICO should have the power to inspect data controllers at will — like the HSE. This is crucial.

Second, where companies are involved in violations of the DPA which are egregious — like leaks of large amount of personal information — there should be a duty to disclose this to the ICO. See the HoL Personal Security Online report.