Its the Human Tissue Act 2004
Forget the Data Protection Act. Giving the result of DNA analysis to third parties without consent is specifically illegal, and both the manager and the organisation are liable to criminal prosecution.
There is an exemption for the detection and prevention of crime (and my reading of the act is that there should be a specific crime that will be prevented/detected), but this does not apply to general forensic research. It also says nothing about anonymising the data so it would be illegal whether or not the data is anonymised.
There is an equivalent act in Scotland.
Biting the hand that feeds IT
