"There would be protocols in place to ensure that the data was being stored and used appropriately (covered by the Data Protection Act). "
Do not sleep so soundly, sp. The first of the eight principles of the Data Protection Act (which is the principle which deals with the holding and processing of individuals' data) does not apply. From Schedule 1, Part 1 "The Principles":-:
Crime and taxation.
(1)Personal data processed for any of the following purposes—
(a)the prevention or detection of crime,
(b)the apprehension or prosecution of offenders, or
(c)the assessment or collection of any tax or duty or of any imposition of a similar nature,
are exempt from the first data protection principle (except to the extent to which it requires compliance with the conditions in Schedules 2 and 3) and section 7 in any case to the extent to which the application of those provisions to the data would be likely to prejudice any of the matters mentioned in this subsection.
The police will not trouble themselves with such a tiresome matter as the protections the DPA is supposed to provide. Any enquiries they make will be associated with "the prevention and detection of crime". I have nothing to hide but do not want my medical records shared or made available to anybody. I have opted out of the various (and usually abandoned) schemes to share my information. Time will tell whether my options have been ignored. My money is on the fact that they have.