The Data Protection Act
The consultation focuses on data sets that already exist, but does not distinguish between data that has been collected on an opt-in basis and data that individuals have been obliged to hand over. How data sets came into existence is important - there is a difference between information that was freely volunteered for any use and information that people gave for a specified purpose or because they were compelled to do so in order to avoid a financial penalty or obtain a crucial service. Using data for a purpose other than which it was given, without informing the subjects of the data at the outset, is in breach of the Data Protection Act.
If data is to be released, publication must be permissible under the terms of the original collection, unless the data is fully and properly anonymised - it is usually unfeasible to retroactively gain informed consent. For example, if a company wants to release a person's CV for medical research, it has to either:
(i) have asked that person for permission at the time of obtaining the CV,
(ii) revert to that person and ask permission for this use of the CV, or
(iii) completely anonymise the data, which means deleting not just the person's name and address, but also their education history, any distinctive hobbies, potentially sections of their employment history and anything else that could you be used to identify him or her.