ICO enforcement action? Or police?
Good point. It'd be hard (well, impossible) for the ICO to go after them if they're not actively trading in the UK, but if that customer list were to leak, I'd hope the police would be verrrrry interested in a list of UK customers. Data Protection Act would be the least of their troubles, the Computer Misuse Act would be my preferred tool. Fines aren't going to be enough to wake people up to the fairly obvious fact that cyber-stalking is flat-out illegal.
PS I wonder if this was the tool Rob Titchener installed on Helen's phone? # TiNC