That sounds like the UK’s Data Protection Act, soon to be replaced with an EU successor that will apparently cause all sorts of interesting times if the UK tries to get rid of it post-Brexit.