...Protection Act, members of the public can demand to see all data about them held by a company. Such a 'subject accessrequest' must be satisfied by the company within 40 calendar days of it receiving the demand. Public sector bodies must...
http://www.computerweekly.com/Articles/2004/10/04/205631/dont-be-an-outlaw.htm