Thank you, Capvermell, for the considerable added insight on this offshore data collection operation. As far as the ICO and OFCOM are concerned, I suppose they are powerless to act outside of their jurisdiction, or with overseas authorities where data protection laws are 'inadequate'. Of course, it's also the case that the ICO were stretched in their resources even before Lehmans, and must now be operating under increasing budgetary constraints. What's really needed is a way to pin the bulk acquisition of their data onto UK lifestyle data aggregators or resellers. I cannot believe that with the amount of data that is doubtlessly being collected out of that Indian operation, that there are not large data companies in the UK who are taking significant data feeds in. Of course, they may be unwittingly doing so, perhaps as a result of being 'cleaned/ laundered' through ostensibly credible sources. In a world where bulk public sources of data are contracting (eg The Electoral role changes) the pressure within large data organisations for plugging the widening, yawning gap in coverage, must be greater than ever. Experienced direct marketing professionals know that the only other way to gap plug is to model out data, creating large tracts of 'implied' consumer profiles - code for guesswork. They also know that this implied data works significantly less well than real data. Maybe they are less well aware that analysts who create their customer models on the back of this data will automatically score incoming implied data more highly than real, patchier, inputs. What this means is that there is a ready market for bulk data sources of real data that can plug those big gaps. There will be wholesale buyers of this stuff, make no mistake. How can we fight back, and identify UK based sources that contain data collected out of this Indian operation? One sure way is to participate in the survey, fully, but provide a modified 'seed' name that you know can only have been collected via one phone call, recorded to a specific day and time when you accepted the call from the Indian call centre. The seed data you provide must comprise a slightly modified name, but also you may choose to provide data about TV subscriptions and Insurance Renewal Dates, that is wrong. If you are then contacted by a UK company with the seed name, you will know where the data came from at source. The next step is to determine whether that data was bought via a UK data supplier, and if need be can use the Subject Access Request rules under the DPA 1998 to gain access to the database record that triggered the campaign or contact. A handful of individuals in a collaborative 'seed network' will provide sufficient information for the ICO to take action against UK companies who buy this data, and deter market participants from funding this unacceptable type of offshore operation.