Here we go:
DATA PROTECTION AS PROMISED
This is the point of law on Data Protection
Exemptions
There are some circumstances in which you will not face any legal obligations, even if you hold information about other people for non-domestic purposes.
To decide whether this is the case, you need to consider to whom the information relates and how is it held.
No obligations under the DPA arise where the information relates to businesses, companies or other organisations.
If the information you hold relates to living individuals who can be identified by the information, then the legal obligations contained within the DPA are likely to apply to you.
If information you hold does not in itself identify an individual but it could be used to identify an individual when combined with other information you hold, or expect to hold at some point in the future, then the obligations are also likely to apply to you.
If you hold such information electronically (e.g. on a computer), or in certain types of paper-based filing systems, then the information is 'personal data' and the DPA will impose certain legal obligations on you.
I have been advised that
If a company holds personal information on a person(s) then that information should not be disclosed to a third party without prior written consent. If any information is given that does not disclose the identity of the said person then that is not a matter of data protection.
Asking a person if a client has obtained work through their client is not a breach of data protection, especially if that client is appearing in a model book provided to the public, whether it be electronic or hard copy, provided that the person does not disclose any personal information regarding that client in the process of.