Number 1. MAKE A COMPLAINT TO THE HOSPITAL.
One of the major problems is that no matter how much women complain on MN they are not complaining to the hospitals in question. Hospitals are using this as a way to support Bounty, by saying "well we've had no complaints" or that Bounty have high levels of satisfaction. This is the number one thing you need to do to register with authorities that you believe that this company have taken advantage of a situation in which you are vulnerable. What hospitals and Bounty say does not match what NCT and MN surveys said and the message needs to go to hospitals that women do not like this.
Number 2. COMPLAIN TO BOUNTY
Yes I am pretty damn sure they are in breach of the DPA. They need to EXPLICITLY state what they are using the data for (eg in this case to sell on to third parties for marketing - they can not legally state that it is to join a parenting club as that is misleading). Failure to do so, is in breach of ICO rules. In order to complain to the ICO, you are supposed to complain to the company in question... which if you don't trust them and don't want to give them your details is not really what you want to do. However if they always have your details you don't have a lot to loose. The trouble is, by now they may have already sold your information to third parties, and out of their control. The ICO will not handle your complaint unless Bounty have been given the opportunity to correct the problem first.
You can also do a "Subject Access Request" to businesses. They have to provide you with all the information they hold on you (including who they sent your details on you). They can charge £10 at most for this request. They have to reply within 40 days. It has to be sent to the Compliance Manager who should be publicly noted. (I did previously put a link to Bounty's Compliance Manager's linked in profile who was Sarah Wragg, but the profile no longer exists).
You would need to send recorded delivery to prove they had received your request. ??If they don't respond you would then contact the ICO as non compliance is a breach of the data protection act. ??Technically, I believe that all staff working for Bounty should have data protection training as part of their compliance. Its believe it may be a legal necessity due to where they work. Whether they are doing this or not, I haven't established.
The ICO rules were tightened back in September; the register ran a great article on what this means here
Number 3. COMPLAIN TO THE ICO
You can only do this if Bounty do not respond to the above to your satisfaction.
Full details of how to complain should you get to this point here
Number 4. CONSIDER A COMPLAINT TO TRADING STANDARDS.
I've posted about this previously about how I believe this type of behaviour is in breech of trading standards.
Rather than copying the whole lot again, the information is on this thread www.mumsnet.com/Talk/mumsnet_campaigns/a1641617-just-had-a-run-in-with-the-maternity-ward-bounty-photographer
Posts by me on Fri 21-Dec-12 23:54:57 and Sat 22-Dec-12 00:26:12 give you a good outline of why its dodgy, but I've made other posts about it which give further detail, including links on that that and on the subsequent later thread:
www.mumsnet.com/Talk/mumsnet_campaigns/a1777511-Campaign-to-end-Bounty-reps-access-to-maternity-wards-please-read-and-help-if-you-can
As far as I am aware no one has taken this approach yet - it is begging for someone to do it, but it can only be someone who has a complaint themselves and not on behalf of someone.
They do not need to sell you photos to be covered under this; selling your details on to a third party is a commercial and financial transaction so I believe is covered (read the The Consumer Protection from Unfair Trading Regulations 2008 for more info here.
Hope that points you in the right direction, if you are serious about doing this. Happy to help if you need it, though I could bore the hind leg off a donkey with this subject, so you've been warned!!!