In article , Matthew
Malthouse writes

Since a tightening up that came into force January such data may only
be used for the purpose for which it was gathered.

Huh? What happened in January. The most recent DPA came into force in
1998.

Lots happened. Various provisions of ammending legislation came into
force. There has been lots of it:

[snip]

None of these is relevant to the basic DPA principle that "data may only
be used for the purpose for which it was gathered".

} Further they may now only do so for a year before again ascertaining
} your willingness to be spammed. Without your extended permission they
} have to expunge "the data" ie your e-mail address.
}
} I'm not aware of any "1 year timeout" on permission. Source, please.

It is what the sharks said was required when we built a new user
registration system earlier this year. I don't know off hand which
particular part of the original or ammending legislation covers it.

I think you'll find that none of it does.
--
"now, the thing you type on and the window you stare out of are the same thing"